JP2004282657A - Personal information protecting method, commodity ordering terminal, commodity order receiving server, personal information transmitting program, and personal information receiving program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a personal information protecting method, commodity ordering terminal, commodity order receiving server, personal information transmitting program and personal information receiving program in which personal information to be transmitted from the side of a commodity ordering person to the side of an order receiving person is encrypted with a public key that does not require key certification using a certification agent, the communication cost is reduced, and personal information of the ordering person can be protected. <P>SOLUTION: The method is characterised in that, in the ordering terminal 10, public recipient information (public information Pinfo) generated from private recipient information that is recipient's side private information specifying the ordering person, is acquired by a public information acquisition means 11, identification information for identifying the ordering person is defined as a public key Uid and on the basis of the public key Uid, the public information Pinfo and ordering person's private information (r) that is private information of the ordering person, personal information M is encrypted. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

【００６６】
以上、説明したように商品発注端末１０では、発注者を識別する識別情報を公開鍵Ｕｉｄとして、商品受注サーバ２０が公開する公開情報Ｐｉｎｆｏに基づいて、発注者の個人情報Ｍを暗号化して、商品受注サーバ２０へ送信する。また、商品受注サーバ２０では、暗号化された個人情報Ｍを秘密鍵Ｕ_Ｍにより復号する。このように、商品発注端末１０と商品受注サーバ２０とは独立して鍵の管理を行うことが可能になる。
以下、本発明に係る商品発注端末１０及び商品受注サーバ２０について詳細に説明する。
【００６７】
（商品発注端末１０の構成）
まず、図２を参照（適宜図１参照）して、商品発注端末１０の構成について説明する。図２は、商品発注端末１０の構成を示すブロック図である。図２に示すように、商品発注端末１０は、発注者が商品を発注する際に、商品名、クレジットカード番号等の個人情報（商品要求書）Ｍを暗号化した商品要求を、商品受注サーバ２０へ送信するものである。ここでは、商品発注端末１０を、公開情報取得手段１１と、ＩＤベース暗号化手段１３と、発注者公開情報生成手段１４と、合成手段１５と、記憶手段１６と、送受信手段１７とを備えて構成した。
【００６８】
公開情報取得手段１１は、商品受注サーバ２０に対して、発注者の登録（ユーザ登録）を行い、商品受注サーバ２０が公開する公開情報（受注者公開情報）Ｐｉｎｆｏを取得するものである。ここでは、公開情報取得手段１１を、発注者登録部１１ａと公開情報取得部１１ｂとで構成した。
【００６９】
発注者登録部１１ａは、図示していない入力手段を介して、発注者が発注者の名前等を含んだ発注者登録情報Ｕを入力し、その発注者登録情報Ｕを、送受信手段１７の登録要求送信部１７ａを介して商品受注サーバ２０へ送信するものである。なお、この発注者登録は、商品の発注を行う発注者のみが必要であり、１度登録を行うだけでよい。
【００７０】
公開情報取得部１１ｂは、発注者登録部１１ａによる発注者登録の結果として、商品受注サーバ２０から送信される公開情報Ｐｉｎｆｏ｛ｐ，ｑ，Ｅ，Ｐ，Ｌｐｕｂ，Ｆ（・），Ｈ（・），ｅ（・，・）｝と、発注者を識別する識別情報である公開鍵Ｕｉｄとを、送受信手段１７の公開情報受信部１７ｂから受信し、記憶手段１６に記憶するものである。
【００７１】
ＩＤベース暗号化手段１３は、発注者が発注する商品名、料金の支払に使用するクレジットカード番号等の個人情報Ｍを、公開鍵Ｕｉｄで暗号化するものである。ここでは、ＩＤベース暗号化手段１３を、発注者秘密情報選択部１３ａと、ＩＤ暗号化部１３ｂとで構成した。
【００７２】
発注者秘密情報選択部１３ａは、集合｛１，２，…，ｑ−１｝（ｑ：位数）から任意の１つの値を選択して出力するものである。ここで選択された値は発注者秘密情報ｒとして、ＩＤ暗号化部１３ｂ及び発注者公開情報生成手段１４に通知される。
【００７３】
ＩＤ暗号化部１３ｂは、図示していない入力手段から個人情報（商品要求書）Ｍを入力し、ＩＤ暗号方式による暗号化を行い暗号化要求書Ｃ_Ｍを生成するものである。このＩＤ暗号化部１３ｂでは、入力された個人情報（商品要求書）Ｍと、発注者秘密情報選択部１３ａで選択された発注者秘密情報ｒと、記憶手段１６に記憶されている公開鍵Ｕｉｄ及び公開情報Ｐｉｎｆｏの鍵公開情報Ｌｐｕｂとを、同じく公開情報Ｐｉｎｆｏの関数Ｆ（・）、関数ｅ（・，・）及び関数Ｈ（・）に基づいて、前記（３）式により、ＩＤ暗号方式による暗号化を行い暗号化要求書Ｃ_Ｍを生成する。なお、ここで生成された暗号化要求書Ｃ_Ｍは、合成手段１５へ通知される。
【００７４】
発注者公開情報生成手段１４は、発注者秘密情報選択部１３ａで選択された発注者秘密情報ｒと、記憶手段１６に記憶されている公開情報Ｐｉｎｆｏの元Ｐとを乗算（前記（４）式）し、発注者の公開情報である発注者公開情報Ｐｐｕｂを生成するものである。なお、ここで生成された発注者公開情報Ｐｐｕｂは、合成手段１５へ通知される。
【００７５】
合成手段１５は、ＩＤ暗号化部１３ｂで生成された暗号化要求書Ｃ_Ｍと、発注者公開情報生成手段１４で生成された発注者公開情報Ｐｐｕｂとを合成し、暗号化個人情報ＥＣ_Ｍ（＝｛Ｃ_Ｍ，Ｐｐｕｂ｝）を生成するものである。この合成手段１５における合成は、入力されたデータ（｛Ｃ_Ｍ，Ｐｐｕｂ｝）を単純に連結し、その連結した位置を書き込んだヘッダ情報を暗号化個人情報ＥＣ_Ｍに付加するものとする。あるいは、合成する側と分離する側とで予め定めた配置によって、合成することとしてもよい。この合成手段１５で合成された暗号化個人情報ＥＣ_Ｍは、送受信手段１７の商品要求送信部（個人情報送信手段）１７ｃへ通知される。
【００７６】
記憶手段１６は、公開情報取得手段１１で取得した公開情報Ｐｉｎｆｏ｛ｐ，ｑ，Ｅ，Ｐ，Ｌｐｕｂ，Ｆ（・），Ｈ（・），ｅ（・，・）｝と、発注者を識別する識別情報である公開鍵Ｕｉｄとを記憶するもので、一般的なハードディスク等で構成されるものである。
【００７７】
送受信手段１７は、商品受注サーバ２０へのデータ送信、並びに、商品受注サーバ２０からのデータ受信を行うものである。ここでは、送受信手段１７を登録要求送信部１７ａと、公開情報受信部１７ｂと、商品要求送信部１７ｃとで構成した。
【００７８】
登録要求送信部１７ａは、発注者登録部１１ａから通知（入力）される発注者登録情報Ｕを含んだ登録要求を、ネットワーク（インターネット３等）を介して、商品受注サーバ２０へ送信するものである。
【００７９】
公開情報受信部１７ｂは、登録要求送信部１７ａで送信した登録要求の結果として、商品受注サーバ２０が公開する公開情報Ｐｉｎｆｏ及び発注者の識別情報である公開鍵Ｕｉｄを、ネットワークを介して、商品受注サーバ２０から受信するものである。ここで受信した公開情報Ｐｉｎｆｏ及び公開鍵Ｕｉｄは、公開情報取得部１１ｂへ通知される。
【００８０】
商品要求送信部（個人情報送信手段）１７ｃは、合成手段１５で合成された暗号化個人情報ＥＣ_Ｍを、ネットワークを介して、商品受注サーバ２０へ送信するものである。なお、この商品要求送信部（個人情報送信手段）１７ｃでは、発注者を識別するため、公開鍵Ｕｉｄを暗号化個人情報ＥＣ_Ｍに付加して商品受注サーバ２０へ送信している。
【００８１】
以上、一実施形態に基づいて、商品発注端末１０の構成について説明したが、公開鍵Ｕｉｄは、必ずしも商品受注サーバ２０から取得する必要はない。例えば、発注者の名前等、発注者を識別する情報を発注者登録情報Ｕとして発注者登録（ユーザ登録）し、発注者を識別する情報（名前等）そのものを公開鍵Ｕｉｄとしてもよい。
【００８２】
また、発注者登録部１１ａを用いずに、受注者に対して郵送等によって発注者登録を行うことで公開鍵Ｕｉｄを取得することとしてもよい。この場合は、公開情報取得手段１１は、図示していない入力手段から入力された公開鍵Ｕｉｄを、商品受注サーバ２０へ送信することで公開情報Ｐｉｎｆｏを取得することとなる。
【００８３】
なお、商品発注端末１０は記憶手段１６以外の各手段を、コンピュータにおいて機能プログラムとして実現することも可能であり、各機能プログラムを結合して個人情報送信プログラムとして動作させることも可能である。
【００８４】
（商品受注サーバ２０の構成）
次に、図３を参照（適宜図１参照）して、商品受注サーバ２０の構成について説明する。図３は、商品受注サーバ２０の構成を示すブロック図である。図３に示すように、商品受注サーバ２０は、商品発注端末１０から送信される登録要求により、発注者の登録を行うとともに、商品発注端末１０から送信される発注者の個人情報を含んだ商品要求を受信して、登録のあった発注者からの商品の受注を行うものである。ここでは、商品受注サーバ２０を、公開情報公開手段２１と、分離手段２２と、ＩＤベース復号手段２３と、記憶手段２４と、送受信手段２５とを備えて構成した。
【００８５】
公開情報公開手段２１は、送受信手段２５の登録要求受信部２５ａから通知される発注者登録情報Ｕに基づいて、発注者の登録を行い、その発注者に対して公開情報を公開するものである。ここでは、公開情報公開手段２１を、発注者登録受付部２１ａと、公開情報生成部２１ｂと、公開情報公開部２１ｃとで構成した。
【００８６】
発注者登録受付部２１ａは、登録要求受信部２５ａから通知される発注者登録情報Ｕに基づいて、発注者の登録を行うものである。この発注者登録受付部２１ａでは、発注者毎に、発注者を識別する識別情報である公開鍵Ｕｉｄを生成し、記憶手段２４に記憶することで、発注者の登録を行う。この公開鍵Ｕｉｄは、発注者毎に固有の識別子であって、例えば、発注者登録情報Ｕに含まれる名前等に対応付けて生成されるものである。
【００８７】
公開情報生成部２１ｂは、発注者登録を行った発注者（商品発注端末１０）に対して公開する公開情報を生成するものである。
この公開情報生成部２１ｂでは、（ｑ＞３）の素数で、ｐが（ｐ ｍｏｄ ３＝２）及び（ｐ＝６ｑ−１）となる素数ｐ及びｑを選択し、位数がｑとなる有限体ＧＦ（ｐ）上の楕円曲線Ｅ／ＧＦ（ｐ）の要素である元Ｐを選択する。さらに、一方向性関数である関数Ｆ（・）を選択する。そして、この素数ｐ及びｑ、楕円曲線Ｅ、元Ｐ並びに関数Ｆ（・）を識別情報（公開鍵）Ｕｉｄに対応付けて記憶手段２４に記憶しておく。
【００８８】
さらに、公開情報生成部２１ｂは、１から（ｑ−１）の範囲の整数で、任意の値を選択してマスタ鍵（受注者秘密情報）ｓとし、元Ｐとマスタ鍵ｓとに基づいて、前記（２）式により、鍵公開情報Ｌｐｕｂを生成する。このマスタ鍵ｓ及び鍵公開情報Ｌｐｕｂも、公開鍵Ｕｉｄに対応付けて記憶手段２４に記憶される。
【００８９】
公開情報公開部２１ｃは、発注者登録を行った発注者（商品発注端末１０）に対応する公開情報Ｐｉｎｆｏ及び公開鍵Ｕｉｄを、記憶手段２４から読み出し、商品発注端末１０に対して公開するものである。ここで公開情報公開部２１ｃは、公開情報Ｐｉｎｆｏ及び公開鍵Ｕｉｄを、公開情報送信部２５ｂを介して、商品発注端末１０へ送信することで情報の公開を行う。
【００９０】
分離手段２２は、商品要求受信部２５ｃから通知される暗号化個人情報ＥＣ_Ｍを、暗号化要求書Ｃ_Ｍと、発注者公開情報Ｐｐｕｂとに分離するものである。ここで分離された暗号化要求書Ｃ_Ｍ及び発注者公開情報Ｐｐｕｂは、ＩＤベース復号手段２３のＩＤ復号部２３ｂへ通知される。
【００９１】
ＩＤベース復号手段２３は、分離手段２２で分離された暗号化要求書Ｃ_Ｍを、同じく分離手段２２で分離された発注者公開情報Ｐｐｕｂと、送受信手段２５の商品要求受信部２５ｃから通知される公開鍵Ｕｉｄと、記憶手段２４に記憶されている公開情報Ｐｉｎｆｏとに基づいて、個人情報（商品要求書）Ｍに復号するものである。ここでは、ＩＤベース復号手段２３を、秘密鍵生成部２３ａと、ＩＤ復号部２３ｂとで構成した。
【００９２】
秘密鍵生成部２３ａは、商品要求受信部２５ｃから通知される公開鍵Ｕｉｄと、その公開鍵Ｕｉｄに対応して記憶手段２４に記憶されているマスタ鍵ｓと、関数Ｆ（・）とに基づいて、前記（５）式により、秘密鍵Ｕ_Ｍを生成するものである。ここで生成した秘密鍵Ｕ_Ｍは、ＩＤ復号部２３ｂへ通知される。なお、この秘密鍵Ｕ_Ｍは、ＩＤ復号部２３ｂが行う復号時の復号鍵となるものである。
【００９３】
ＩＤ復号部２３ｂは、分離手段２２で分離された暗号化要求書Ｃ_Ｍを、ＩＤ暗号方式における復号処理によって、個人情報（商品要求）Ｍに復号するものである。このＩＤ復号部２３ｂでは、暗号化要求Ｃ_Ｍを、秘密鍵生成部２３ａで生成された秘密鍵Ｕ_Ｍと、分離手段２２で分離された発注者公開情報Ｐｐｕｂと、記憶手段２４に記憶されている関数Ｈ（・）及び関数ｅ（・，・）とに基づいて、前記（６）式により復号し個人情報（商品要求書）Ｍとする。
【００９４】
記憶手段２４は、公開情報Ｐｉｎｆｏ｛ｐ，ｑ，Ｅ，Ｐ，Ｌｐｕｂ，Ｆ（・），Ｈ（・），ｅ（・，・）｝と、発注者を識別する識別情報となる公開鍵Ｕｉｄと、マスタ鍵（受注者秘密情報）ｓとを記憶するもので、一般的なハードディスク等で構成されるものである。
【００９５】
この記憶手段２４には、素数ｐ及びｑ、楕円曲線Ｅ、元Ｐ及び関数Ｆ（・）が複数記憶されており、公開情報生成部２１ｂが、公開鍵Ｕｉｄに対応付けてそれらを選択し、公開情報Ｐｉｎｆｏとして公開するものとする。また、鍵公開情報Ｌｐｕｂは、公開情報生成部２１ｂによって生成されるものである。また、関数Ｈ（・）及び関数ｅ（・，・）は、予め前記（１）式を満たす固有の関数とする。
【００９６】
送受信手段２５は、商品発注端末１０へのデータ送信、並びに、商品発注端末１０からのデータ受信を行うものである。ここでは、送受信手段２５を、登録要求受信部２５ａと、公開情報送信部２５ｂと、商品要求受信部２５ｃとで構成した。
【００９７】
登録要求受信部２５ａは、商品発注端末１０から、ネットワーク（インターネット３等）を介して送信される、発注者登録情報Ｕを含んだ登録要求を受信するものである。ここで受信した発注者登録情報Ｕは、発注者登録受付部２１ａへ通知される。
【００９８】
公開情報送信部２５ｂは、公開情報公開部２１ｃから通知（入力）される公開情報Ｐｉｎｆｏ及び公開鍵Ｕｉｄを、ネットワーク（インターネット３等）を介して、商品発注端末１０へ送信（公開）するものである。
【００９９】
商品要求受信部（個人情報受信手段）２５ｃは、商品発注端末１０から、ネットワーク（インターネット３等）を介して送信される、暗号化個人情報ＥＣ_Ｍ及び公開鍵Ｕｉｄを含んだ商品要求を受信するものである。ここで受信した暗号化個人情報ＥＣ_Ｍは、分離手段２２へ通知され、公開鍵Ｕｉｄは、ＩＤベース復号手段２３へ通知される。
【０１００】
以上、一実施形態に基づいて、商品受注サーバ２０の構成について説明したが、本発明は、これに限定されるものではない。例えば、秘密鍵生成部２３ａにおける秘密鍵Ｕ_Ｍの生成を、個人情報の復号時に行うのではなく、発注者登録時に行い、その生成した秘密鍵Ｕ_Ｍを記憶手段２４に保存しておくこととしてもよい。
【０１０１】
なお、商品受注サーバ２０は記憶手段２４以外の各手段を、コンピュータにおいて機能プログラムとして実現することも可能であり、各機能プログラムを結合して個人情報受信プログラムとして動作させることも可能である。
【０１０２】
（受発注システム１の動作）
次に、図４乃至図６を参照して、受発注システム１（図１）における商品発注端末１０及び商品受注サーバ２０の動作について説明する。図４は、商品受注サーバ２０が、商品発注端末１０に対して公開情報を公開する動作を示すフローチャートである。図５は、商品発注端末１０が、商品受注サーバ２０に対して発注者の個人情報を暗号化して送信する動作を示すフローチャートである。図６は、商品受注サーバ２０が、商品発注端末１０から暗号化された個人情報を受信して復号する動作を示すフローチャートである。
【０１０３】
まず、図４を参照（構成については図２及び図３参照）して、商品受注サーバ２０が、商品発注端末１０に対して公開情報（受注者公開情報）を公開する動作について説明する。
【０１０４】
＜情報公開ステップ＞
まず、商品発注端末１０が、発注者登録部１１ａによって、発注者の名前等を含んだ発注者登録情報Ｕを入力し、登録要求送信部１７ａによって、商品受注サーバ２０に対して、発注者登録情報Ｕを含んだ登録要求を送信することで、発注者登録（ユーザ登録）を行う（ステップＳ１０）。
【０１０５】
商品受注サーバ２０では、登録要求受信部２５ａで登録要求を受信し（ステップＳ１１）、発注者登録受付部２１ａによって、発注者毎に、発注者を識別する識別情報である公開鍵Ｕｉｄを生成し、記憶手段２４に記憶しておく（ステップＳ１２）。
【０１０６】
そして、商品受注サーバ２０は、公開情報生成部２１ｂによって、１から（位数ｑ−１）の範囲の整数でマスタ鍵（受注者秘密情報）ｓを選択し（ステップＳ１３）、そのマスタ鍵ｓに基づいて、鍵公開情報Ｌｐｕｂを生成（前記（２）式）するとともに、他の公開情報｛ｐ，ｑ，Ｅ，Ｐ，Ｆ（・）｝を選択し、記憶手段２４に記憶する（ステップＳ１４）。
【０１０７】
そして、商品受注サーバ２０は、公開情報公開部２１ｃによって、ステップＳ１４で選択／生成した公開情報Ｐｉｎｆｏと、ステップＳ１２で生成した公開鍵Ｕｉｄとを、公開情報送信部２５ｂを介して、商品発注端末１０へ送信する（ステップＳ１５）。
一方、商品発注端末１０では、公開情報受信部１７ｂで公開情報Ｐｉｎｆｏと公開鍵Ｕｉｄとを受信し、記憶手段１６に記憶しておく（ステップＳ１６）。
【０１０８】
以上の動作によって、商品発注端末１０は、商品受注サーバ２０に対して、発注者の登録を行い、その発注者の個人情報Ｍを暗号化するために必要となる公開情報Ｐｉｎｆｏを取得することができる。なお、ここでは、発注者登録と同時に公開情報Ｐｉｎｆｏの取得を行っているが、先に発注者登録のみを行い、公開鍵Ｕｉｄを取得しておき、その後に、その公開鍵Ｕｉｄに基づいて、公開情報Ｐｉｎｆｏを取得することとしてもよい。
【０１０９】
次に、図５を参照（適宜図２参照）して、商品発注端末１０が、個人情報Ｍを暗号化して商品受注サーバ２０（図１）へ送信する動作について説明する。
【０１１０】
＜個人情報（商品要求）暗号化ステップ＞
まず、商品発注端末１０は、図示していない入力手段によって、発注者が発注する商品名、料金の支払に使用するクレジットカード番号等の個人情報（商品要求書）Ｍを入力する（ステップＳ２０）。そして、発注者秘密情報選択部１３ａによって、１から（位数ｑ−１）の範囲の整数で発注者秘密情報ｒを選択する（ステップＳ２１）。
【０１１１】
そして、商品発注端末１０は、ＩＤ暗号化部１３ｂによって、ステップＳ２０で入力された個人情報Ｍと、ステップＳ２１で選択された発注者秘密情報ｒと、記憶手段１６に記憶されている発注者の識別情報である公開鍵Ｕｉｄ及び公開情報Ｐｉｎｆｏに含まれる鍵公開情報Ｌｐｕｂとを、同じく公開情報Ｐｉｎｆｏに含まれる関数Ｆ（・）、関数ｅ（・，・）及び関数Ｈ（・）に基づいて、前記（３）式により、ＩＤ暗号方式による暗号化を行い暗号化要求書Ｃ_Ｍを生成する（ステップＳ２２）。
【０１１２】
さらに、商品発注端末１０は、発注者公開情報生成手段１４によって、ステップＳ２１で選択された発注者秘密情報ｒと、記憶手段１６に記憶されている公開情報Ｐｉｎｆｏに含まれる元Ｐとを乗算（前記（４）式）し、発注者の公開情報である発注者公開情報Ｐｐｕｂを生成する（ステップＳ２３）。
【０１１３】
そして、商品発注端末１０は、合成手段１５によって、ステップＳ２２で生成された暗号化要求書Ｃ_Ｍと、ステップＳ２３で生成された発注者公開情報Ｐｐｕｂとを合成して、暗号化個人情報ＥＣ_Ｍを生成し（ステップＳ２４）、商品要求送信部（個人情報送信手段）１７ｃによって、暗号化個人情報ＥＣ_Ｍと公開鍵Ｕｉｄとを商品受注サーバ２０（図１）へ送信する（ステップＳ２５）。
【０１１４】
以上の動作によって、商品発注端末１０は、認証局等の第三機関が認証した鍵を用いることなく、さらに、商品受注サーバ２０（図１）との間で公開された情報以外の情報交換を行うことなく、個人情報Ｍを暗号化することができる。
【０１１５】
次に、図６を参照（適宜図３参照）して、商品受注サーバ２０が、商品発注端末１０から暗号化された個人情報を受信して復号する動作について説明する。
【０１１６】
＜個人情報（商品要求）復号ステップ＞
まず、商品受注サーバ２０は、商品要求受信部（個人情報受信手段）２５ｃによって、暗号化個人情報ＥＣ_Ｍ及び公開鍵Ｕｉｄを含んだ商品要求を受信する（ステップＳ３０）。
【０１１７】
そして、商品受注サーバ２０は、分離手段２２によって、暗号化個人情報ＥＣ_Ｍを、暗号化要求書Ｃ_Ｍと発注者公開情報Ｐｐｕｂとに分離する（ステップＳ３１）。
【０１１８】
また、商品受注サーバ２０は、ＩＤベース復号手段２３の秘密鍵生成部２３ａによって、ステップＳ３０で受信した公開鍵Ｕｉｄと、その公開鍵Ｕｉｄに対応して記憶手段２４に記憶されているマスタ鍵ｓと、関数Ｆ（・）とに基づいて、前記（５）式により、秘密鍵Ｕ_Ｍを生成する（ステップＳ３２）。
【０１１９】
そして、商品受注サーバ２０は、ＩＤ復号部２３ｂにおいて、暗号化要求書Ｃ_Ｍを、ステップＳ３２で生成された秘密鍵Ｕ_Ｍと、ステップＳ３１で分離された発注者公開情報Ｐｐｕｂと、記憶手段２４に記憶されている関数Ｈ（・）及び関数ｅ（・，・）とに基づいて、前記（６）式により、ＩＤ暗号方式による復号を行い個人情報（商品要求書）Ｍとする（ステップＳ３３）。
【０１２０】
以上の動作によって、商品受注サーバ２０は、商品発注端末１０で暗号化された個人情報を、認証局等の第三機関が認証した鍵を用いることなく復号することができる。
【０１２１】
以上説明したように、本実施の形態における受発注システム１は、商品発注端末１０と商品受注サーバ２０との間で、公開情報以外の情報交換を行わないため、秘匿通信等の必要がない。このため、従来のＳＳＬを使用した場合に生じていた通信コストを低減させることができる。また、受発注システム１は、従来の公開鍵暗号方式とは異なり、復号を行うための復号鍵を保管しておく必要がなく、商品発注端末１０と商品受注サーバ２０とを独立して動作させることが可能となる。
【０１２２】
また、本実施の形態において、商品発注端末１０の発注者秘密情報選択部１３ａが選択する発注者秘密情報ｒ、及び、商品受注サーバ２０の公開情報生成部２１ｂが選択するマスタ鍵ｓは、商品発注端末１０及び商品受注サーバ２０の秘密情報となるものである。この秘密情報は、鍵公開情報Ｌｐｕｂ、発注者公開情報Ｐｐｕｂ、元Ｐ等の公開された情報に基づいて推定することは非常に困難である。この鍵公開情報Ｌｐｕｂ、発注者公開情報Ｐｐｕｂ、元Ｐ等から、発注者秘密情報ｒ及びマスタ鍵ｓを導出する問題は、楕円離散対数問題と呼ばれ、これを解くことは非常に困難であると言われている（岡本龍明、山本博資著、「現代暗号」、産業図書、ｐ．１１９−１２０）。
【０１２３】
なお、秘密情報である発注者秘密情報ｒ及びマスタ鍵ｓが、なんらかの手段によって、第三者に漏洩した場合でも、商品発注端末１０及び商品受注サーバ２０が、新たな発注者秘密情報ｒ及びマスタ鍵ｓを選択し、鍵公開情報Ｌｐｕｂ及び発注者公開情報Ｐｐｕｂを更新するだけで対策を行うことができ、認証機関に鍵を認証してもらう管理費用が発生しない。
【０１２４】
また、本実施の形態においては、Ｂｏｎｅｈ，Ｆｒａｎｋｌｉｎ方式のＩＤ暗号方式を用いて、個人情報の暗号化を行ったが、発注者を識別する識別情報を公開鍵とすることが可能な暗号方式であれば、どのような暗号方式を用いても構わない。
【０１２５】
［受発注システム：第二の実施の形態］
次に、図１を参照して、本発明における第二の実施の形態である受発注システム１Ｂについて説明する。受発注システム１Ｂは、受発注システム１の構成において、商品発注端末１０を商品発注端末１０Ｂに、商品受注サーバ２０を商品受注サーバ２０Ｂに、それぞれ変更したものである。
【０１２６】
（個人情報（商品要求書）の暗号化動作及び復号動作の概要）
ここで、受発注システム１Ｂにおいて、商品発注端末１０Ｂが行う発注者の個人情報を記載した商品要求書の暗号化動作、及び、商品受注サーバ２０が行う商品要求書の復号動作について、その概要を説明する。
【０１２７】
前記した第一の実施の形態である受発注システム１では、個人情報（商品要求書）をＩＤ暗号方式に基づいて暗号化したが、この受発注システム１Ｂでは、個人情報が大きな情報量となり高速化が必要な場合を考慮し、個人情報を一旦共通鍵暗号方式による共通鍵で暗号化し、その共通鍵（暗号鍵）をＩＤ暗号方式に基づいて暗号化することを特徴とする。
【０１２８】
＜公開情報の公開＞
受発注システム１Ｂにおいて、商品受注サーバ２０Ｂが公開する公開情報（受注者公開情報）Ｐｉｎｆｏは、商品受注サーバ２０と同じ｛ｐ，ｑ，Ｅ，Ｐ，Ｌｐｕｂ，Ｆ（・），Ｈ（・），ｅ（・，・）｝とする。
【０１２９】
＜個人情報（商品要求書）の暗号化＞
商品発注端末１０Ｂは、個人情報（商品要求書）を共通鍵で暗号化した暗号化要求書と、ＩＤ暗号方式により共通鍵を暗号化した暗号化共通鍵と、発注者が公開する発注者公開情報とを生成する。ここで、個人情報（商品要求書）の暗号化は、一般的な共通鍵暗号方式であればどの暗号方式を用いても構わない。以下、個人情報（商品要求書）をＭ、暗号化要求書をＣ_Ｍ、共通鍵をＫｓ、暗号化共通鍵をＥｋｓ、発注者公開情報をｒとする。
【０１３０】
まず、商品発注端末１０Ｂは、暗号化共通鍵Ｅｋｓを、公開情報Ｐｉｎｆｏと、発注者を識別する識別情報である公開鍵Ｕｉｄと、集合｛１，２，…，ｑ−１｝（ｑ：位数）から独自に選択した発注者の秘密情報である発注者秘密情報ｒとに基づいて、（１０）式により生成する。
【０１３１】
Ｅｋｓ＝Ｋｓ（＋）Ｈ（ｅ（Ｆ（Ｕｉｄ），Ｌｐｕｂ）^ｒ） （１０）式
【０１３２】
また、商品発注端末１０Ｂは、発注者の公開情報である発注者公開情報Ｐｐｕｂを（１１）式（前記（４）式と同じ）により生成する。
【０１３３】
Ｐｐｕｂ＝ｒ×Ｐ （１１）式
【０１３４】
そして、商品発注端末１０Ｂは、共通鍵Ｋｓで暗号化された暗号化要求書Ｃ_Ｍと、前記した（１０）式及び（１１）式によって生成された暗号化共通鍵Ｅｋｓ及び発注者公開情報Ｐｐｕｂを合成し、暗号化個人情報ＥＣ_Ｍ（＝｛Ｃ_Ｍ，Ｅｋｓ，Ｐｐｕｂ｝）として、商品受注サーバ２０Ｂへ送信する。
【０１３５】
＜個人情報（商品要求書）の復号＞
次に、商品受注サーバ２０Ｂにおける個人情報（商品要求書）の復号動作の概要を説明する。商品受注サーバ２０Ｂは、商品発注端末１０Ｂから受信した暗号化個人情報ＥＣ_Ｍを、暗号化要求書Ｃ_Ｍと暗号化共通鍵Ｅｋｓと発注者公開情報Ｐｐｕｂとに分離し、発注者を識別する公開鍵（識別情報）Ｕｉｄと、その公開鍵Ｕｉｄに対応する受注者側の秘密情報であるマスタ鍵ｓと、関数Ｆ（・）とに基づいて、（１２）式により秘密鍵Ｕ_Ｍを生成する。
【０１３６】
Ｕ_Ｍ＝ｓ×Ｆ（Ｕｉｄ） （１２）式
【０１３７】
そして、商品受注サーバ２０Ｂは、暗号化共通鍵Ｅｋｓと、秘密鍵Ｕ_Ｍと、発注者公開情報Ｐｐｕｂと、関数Ｈ（・）及び関数ｅ（・，・）とに基づいて、（１３）式により暗号化共通鍵Ｅｋｓを共通鍵Ｋｓに復号する。
【０１３８】
Ｅｋｓ（＋）Ｈ（ｅ（Ｕ_Ｍ，Ｐｐｕｂ）） （１３）式
【０１３９】
この（１３）式によって、暗号化共通鍵Ｅｋｓが共通鍵Ｋｓに復号されることを以下に証明しておく。（１３）式は、前記した（１０）式、（１１）式及び（１２）式によって、（１４）式に変形することができる。そして、（１４）式は、（１）式及び（２）式によって、（１５）式に変形することができ、さらに、（１５）式は、（２）式によって、（１６）式に変形することができる。この（１６）式における共通鍵Ｋｓ以外の項は、排他的論理和によって「１」となるため、その結果，共通鍵Ｋｓの項だけが残ることになる。
【０１４０】

【０１４１】
そして、商品受注サーバ２０Ｂは、この復号された共通鍵Ｋｓにより、暗号化要求書Ｃ_Ｍを復号することで、発注者の個人情報Ｍを取得することができる。
以下、本発明に係る商品発注端末１０Ｂ及び商品受注サーバ２０Ｂについて詳細に説明する。
【０１４２】
（商品発注端末１０Ｂの構成）
まず、図７を参照して、商品発注端末１０Ｂの構成について説明する。図７は、商品発注端末１０Ｂの構成を示すブロック図である。図７に示すように、商品発注端末１０Ｂは、発注者が商品を発注する際に、商品名、クレジットカード番号等の個人情報（商品要求書）Ｍを暗号化した商品要求を、商品受注サーバ２０Ｂ（図１）へ送信するものである。
【０１４３】
ここでは、商品発注端末１０Ｂを、公開情報取得手段１１と、共通鍵暗号化手段１２と、ＩＤベース暗号化手段１３Ｂと、発注者公開情報生成手段１４と、合成手段１５Ｂと、記憶手段１６Ｂと、送受信手段１７とを備えて構成した。共通鍵暗号化手段１２、ＩＤベース暗号化手段１３Ｂ、合成手段１５Ｂ及び記憶手段１６Ｂ以外の構成は、図２で説明した商品発注端末１０と同じものであるため、同一の符号を付し、説明を省略する。
【０１４４】
共通鍵暗号化手段１２は、発注者が発注する商品名、料金の支払に使用するクレジットカード番号等の個人情報Ｍを、記憶手段１６Ｂに予め記憶されている共通暗号方式による共通鍵Ｋｓによって暗号化し、暗号化要求書Ｃ_Ｍを生成するものである。例えば、共通鍵暗号化手段１２は、ＤＥＳ（Ｄａｔａ Ｅｎｃｒｙｐｔｉｏｎ Ｓｔａｎｄａｒｄ）等の一般的な共通鍵暗号方式による暗号化を行うものとする。ここで暗号化された暗号化要求書Ｃ_Ｍは、合成手段１５Ｂへ通知される。
【０１４５】
ＩＤベース暗号化手段１３Ｂは、記憶手段１６Ｂに記憶されている共通鍵Ｋｓを、公開鍵Ｕｉｄで暗号化するものである。ここでは、ＩＤベース暗号化手段１３Ｂを、発注者秘密情報選択部１３ａと、ＩＤ暗号化部１３Ｂｂとで構成した。発注者秘密情報選択部１３ａは、図２で説明したものと同一であるので説明を省略する。
【０１４６】
ＩＤ暗号化部１３Ｂｂは、記憶手段１６Ｂに記憶されている共通鍵Ｋｓを、ＩＤ暗号方式による暗号化を行い暗号化共通鍵Ｅｋｓを生成するものである。ここで暗号化された暗号化共通鍵Ｅｋｓは、合成手段１５Ｂへ通知される。なお、このＩＤ暗号化部１３Ｂｂは、ＩＤ暗号化部１３ｂ（図２）の入出力データが異なるだけで、機能はＩＤ暗号化部１３ｂと同じものである。
【０１４７】
合成手段１５Ｂは、共通鍵暗号化手段１２で生成された暗号化要求書Ｃ_Ｍと、ＩＤ暗号化部１３Ｂｂで生成された暗号化共通鍵Ｅｋｓと、発注者公開情報生成手段１４で生成された発注者公開情報Ｐｐｕｂとを合成し、暗号化個人情報ＥＣ_Ｍ（＝｛Ｃ_Ｍ，Ｅｋｓ，Ｐｐｕｂ｝）を生成するものである。この合成手段１５Ｂで合成された暗号化個人情報ＥＣ_Ｍは、送受信手段１７へ通知される。
【０１４８】
記憶手段１６Ｂは、公開情報取得手段１１で取得した公開情報Ｐｉｎｆｏ｛ｐ，ｑ，Ｅ，Ｐ，Ｌｐｕｂ，Ｆ（・），Ｈ（・），ｅ（・，・）｝と、発注者を識別する識別情報である公開鍵Ｕｉｄと、共通鍵暗号方式による暗号化に用いる共通鍵Ｋｓを記憶するもので、一般的なハードディスク等で構成されるものである。
【０１４９】
このように、商品発注端末１０Ｂを構成することで、個人情報Ｍは、共通鍵Ｋｓで暗号化要求書Ｃ_Ｍに暗号化され、共通鍵Ｋｓは、ＩＤ暗号方式により暗号化共通鍵Ｅｋｓに暗号化される。そして、商品発注端末１０Ｂは、暗号化要求書Ｃ_Ｍ及び暗号化共通鍵Ｅｋｓを、発注者公開情報Ｐｐｕｂとともに商品受注サーバ２０Ｂ（図１）に送信することで、個人情報Ｍを安全に商品受注サーバ２０Ｂに通知することができる。
【０１５０】
（商品受注サーバ２０Ｂの構成）
次に、図８を参照して、商品受注サーバ２０Ｂの構成について説明する。図８は、商品受注サーバ２０Ｂの構成を示すブロック図である。図８に示すように、商品受注サーバ２０Ｂは、商品発注端末１０Ｂ（図１）から送信される登録要求により、発注者の登録を行うとともに、商品発注端末１０Ｂから送信される発注者の個人情報を含んだ商品要求を受信して、登録のあった発注者からの商品の受注を行うものである。
【０１５１】
ここでは、商品受注サーバ２０Ｂを、公開情報公開手段２１と、分離手段２２Ｂと、ＩＤベース復号手段２３Ｂと、記憶手段２４と、送受信手段２５と、共通鍵復号手段２６とを備えて構成した。分離手段２２Ｂ、ＩＤベース復号手段２３Ｂ及び共通鍵復号手段２６以外の構成は、図３で説明した商品受注サーバ２０と同じものであるため、同一の符号を付し、説明を省略する。
【０１５２】
分離手段２２Ｂは、送受信手段２５から通知される暗号化個人情報ＥＣ_Ｍを、暗号化要求書Ｃ_Ｍと、暗号化共通鍵Ｅｋｓと、発注者公開情報Ｐｐｕｂとに分離するものである。ここで分離された暗号化共通鍵Ｅｋｓ及び発注者公開情報Ｐｐｕｂは、ＩＤベース復号手段２３ＢのＩＤ復号部２３Ｂｂへ通知される。また、暗号化要求書Ｃ_Ｍは、共通鍵復号手段２６へ通知される。
【０１５３】
ＩＤベース復号手段２３Ｂは、分離手段２２Ｂで分離された暗号化共通鍵Ｅｋｓを、同じく分離手段２２Ｂで分離された発注者公開情報Ｐｐｕｂと、送受信手段２５から通知される公開鍵Ｕｉｄと、記憶手段２４に記憶されている公開情報Ｐｉｎｆｏとに基づいて、共通鍵Ｋｓに復号するものである。ここでは、ＩＤベース復号手段２３Ｂを、秘密鍵生成部２３ａと、ＩＤ復号部２３Ｂｂとで構成した。秘密鍵生成部２３ａは、図３で説明したものと同一であるので説明を省略する。
【０１５４】
ＩＤ復号部２３Ｂｂは、分離手段２２Ｂで分離された暗号化共通鍵Ｅｋｓを、ＩＤ暗号方式における復号処理によって、共通鍵Ｋｓに復号するものである。ここで復号された共通鍵Ｋｓは、共通鍵復号手段２６へ通知される。なお、このＩＤ復号部２３Ｂｂは、ＩＤ復号部２３ｂ（図３）の入出力データが異なるだけで、機能はＩＤ復号部２３ｂと同じものである。
【０１５５】
共通鍵復号手段２６は、分離手段２２Ｂで分離された暗号化要求書Ｃ_Ｍを、ＩＤ復号部２３Ｂｂで復号された共通鍵Ｋｓによって、個人情報（商品要求書）Ｍに復号するものである。
【０１５６】
このように、商品受注サーバ２０Ｂを構成することで、商品発注端末１０Ｂ（図１）から通知される商品要求である暗号化個人情報ＥＣ_Ｍに含まれる暗号化共通鍵Ｅｋｓを、ＩＤ暗号方式による復号で共通鍵Ｋｓに復号し、その共通鍵Ｋｓで暗号化要求書Ｃ_Ｍを、個人情報（商品要求書）Ｍに復号する。
【０１５７】
（受発注システム１Ｂの動作）
次に、図９及び図１０を参照して、受発注システム２（図１）における商品発注端末１０Ｂ及び商品受注サーバ２０Ｂの動作について説明する。図９は、商品発注端末１０Ｂが、商品受注サーバ２０Ｂに対して発注者の個人情報を暗号化して送信する動作を示すフローチャートである。図１０は、商品受注サーバ２０Ｂが、商品発注端末１０Ｂから暗号化された個人情報を受信して復号する動作を示すフローチャートである。なお、商品受注サーバ２０Ｂが、商品発注端末１０Ｂに対して公開情報（受注者公開情報）を公開する動作（情報公開ステップ）は、図４で説明した動作と同様であるため、説明を省略する。
【０１５８】
次に、図９を参照（適宜図７参照）して、商品発注端末１０Ｂが、個人情報Ｍを暗号化して商品受注サーバ２０Ｂ（図１）へ送信する動作について説明する。
【０１５９】
＜個人情報（商品要求）暗号化ステップ＞
まず、商品発注端末１０Ｂは、図示していない入力手段によって、発注者が発注する商品名、料金の支払に使用するクレジットカード番号等の個人情報（商品要求書）Ｍを入力する（ステップＳ４０）。そして、商品発注端末１０Ｂは、共通鍵暗号化手段１２によって、記憶手段１６Ｂに記憶されている共通鍵Ｋｓを用いて個人情報Ｍを暗号化し、暗号化要求書Ｃ_Ｍとする（ステップＳ４１）。
【０１６０】
＜鍵暗号化ステップ＞
また、商品発注端末１０Ｂは、ＩＤベース暗号化手段１３Ｂの発注者秘密情報選択部１３ａによって、１から（位数ｑ−１）の範囲の整数で発注者秘密情報ｒを選択する（ステップＳ４２）。
【０１６１】
そして、商品発注端末１０Ｂは、ＩＤ暗号化部１３Ｂｂによって、ステップＳ４２で選択された発注者秘密情報ｒと、記憶手段１６Ｂに記憶されている発注者の識別情報である公開鍵Ｕｉｄと、公開情報Ｐｉｎｆｏに含まれる鍵公開情報Ｌｐｕｂ、関数Ｆ（・）、関数ｅ（・，・）及び関数Ｈ（・）とに基づいて、ステップＳ４１で用いた共通鍵Ｋｓを、前記（１０）式により、ＩＤ暗号方式による暗号化を行い暗号化共通鍵Ｅｋｓを生成する（ステップＳ４３）。
【０１６２】
＜発注者公開情報生成ステップ＞
さらに、商品発注端末１０Ｂは、発注者公開情報生成手段１４によって、ステップＳ４２で選択された発注者秘密情報ｒと、記憶手段１６Ｂに記憶されている公開情報Ｐｉｎｆｏに含まれる元Ｐとを乗算（前記（１１）式）し、発注者の公開情報である発注者公開情報Ｐｐｕｂを生成する（ステップＳ４４）。
【０１６３】
＜暗号化個人情報送信ステップ＞
そして、商品発注端末１０Ｂは、合成手段１５Ｂによって、ステップＳ４１で暗号化された暗号化要求書Ｃ_Ｍと、ステップＳ４３で暗号化された暗号化共通鍵Ｅｋｓと、ステップＳ４４で生成された発注者公開情報Ｐｐｕｂとを合成して、暗号化個人情報ＥＣ_Ｍを生成し（ステップＳ４５）、送受信手段１７を介して、暗号化個人情報ＥＣ_Ｍと公開鍵Ｕｉｄとを商品受注サーバ２０Ｂ（図１）へ送信する（ステップＳ４６）。
【０１６４】
以上の動作によって、商品発注端末１０Ｂは、認証局等の第三機関が認証した鍵を用いることなく、さらに、商品受注サーバ２０（図１）との間で公開された情報以外の情報交換を行うことなく、個人情報Ｍを暗号化することができる。また、商品発注端末１０Ｂは、個人情報Ｍを一般的な共通鍵暗号方式によって暗号化するため、従来と比較して、ほぼ同程度の速度で暗号化が可能で、さらに、強固に個人情報を保護することができる。
【０１６５】
＜個人情報（商品要求）の復号＞
次に、図１０を参照（適宜図８参照）して、商品受注サーバ２０Ｂが、商品発注端末１０Ｂ（図１）から暗号化された個人情報を受信して復号する動作（暗号化個人情報復号ステップ）について説明する。
【０１６６】
＜暗号化個人情報受信ステップ＞
まず、商品受注サーバ２０Ｂは、送受信手段２５によって、商品発注端末１０（図１）から、暗号化個人情報ＥＣ_Ｍ及び公開鍵Ｕｉｄを含んだ商品要求を受信する（ステップＳ５０）。
【０１６７】
そして、商品受注サーバ２０Ｂは、分離手段２２Ｂによって、暗号化個人情報ＥＣ_Ｍを、暗号化要求書Ｃ_Ｍと暗号化共通鍵Ｅｋｓと発注者公開情報Ｐｐｕｂとに分離する（ステップＳ５１）。
【０１６８】
また、商品受注サーバ２０Ｂは、ＩＤベース復号手段２３Ｂの秘密鍵生成部２３ａによって、ステップＳ５０で受信した公開鍵Ｕｉｄと、その公開鍵Ｕｉｄに対応して記憶手段２４に記憶されているマスタ鍵ｓと、関数Ｆ（・）とに基づいて、前記（１２）式により、秘密鍵Ｕ_Ｍを生成する（ステップＳ５２）。
【０１６９】
＜鍵復号ステップ＞
そして、商品受注サーバ２０Ｂは、ＩＤ復号部２３Ｂｂにおいて、ステップＳ５２で生成された秘密鍵Ｕ_Ｍと、ステップＳ５１で分離された発注者公開情報Ｐｐｕｂと、記憶手段２４に記憶されている関数Ｈ（・）及び関数ｅ（・，・）とに基づいて、前記（１３）式により、ＩＤ暗号方式による復号を行い、暗号化共通鍵Ｅｋｓを共通鍵Ｋｓとする（ステップＳ５３）。
【０１７０】
＜個人情報復号ステップ＞
そして、商品受注サーバ２０Ｂは、共通鍵復号手段２６において、ステップＳ５３で復号された共通鍵Ｋｓを用いて、暗号化要求書Ｃ_Ｍを個人情報（商品要求書）Ｍに復号する（ステップＳ５４）。
【０１７１】
以上の動作によって、商品受注サーバ２０Ｂは、商品発注端末１０Ｂ（図１）で暗号化された個人情報を、認証局等の第三機関が認証した鍵を用いることなく復号することができる。
【０１７２】
【発明の効果】
以上説明したとおり、本発明に係る個人情報保護方法、商品発注端末及び商品受注サーバ、並びに、個人情報送信プログラム及び個人情報受信プログラムでは、以下に示す優れた効果を奏する。
【０１７３】
請求項１に記載の発明によれば、商品発注端末において、発注者のプライバシとなる個人情報を、発注者を特定する公開鍵（識別情報）と受注者公開情報とにより暗号化し、商品受注サーバにおいて、その公開鍵と、発注者公開情報と、受注者公開情報を生成した秘密鍵（受注者秘密情報）とにより、個人情報の復号を行うため、認証局のような第三機関により認められた公開鍵ペアを用いる必要がない。このため、発注側（商品発注端末）と、受注側（商品受注サーバ）とを独立して動作させることが可能になり、ＳＳＬのような双方の秘密情報を通信する必要がなく、秘密情報管理に関わるコストを低減させることができる。
【０１７４】
請求項２に記載の発明によれば、個人情報を暗号化した共通鍵を、発注者を特定する公開鍵（識別情報）と受注者公開情報とにより暗号化し、商品受注サーバにおいて、その公開鍵と、発注者公開情報と、受注者公開情報を生成した秘密鍵（受注者秘密情報）とにより、共通鍵を復号し、その共通鍵で個人情報を復号するため、認証局のような第三機関により認められた公開鍵ペアを用いる必要がない。このため、発注側（商品発注端末）と、受注側（商品受注サーバ）との間で、秘密情報を通信する必要がなく、秘密情報管理に関わるコストを低減させることができる。また、個人情報が大きい場合であっても、共通鍵によって暗号化を行うため、暗号化の処理速度の低減を抑えることができる。
【０１７５】
請求項３又は請求項７に記載の発明によれば、発注者のプライバシとなる個人情報を、発注者を特定する公開鍵（識別情報）と受注者公開情報とにより暗号化を行うため、発注者側と受注者側との間で、秘密情報を通信する必要がなく、秘密情報管理に関わるコストを低減させることができる。
【０１７６】
請求項４に記載の発明によれば、発注者のプライバシとなる個人情報を共通鍵で暗号化し、その共通鍵を、発注者を特定する公開鍵（識別情報）と受注者公開情報とにより暗号化を行うため、発注者側と受注者側との間で、秘密情報を通信する必要がなく、秘密情報管理に関わるコストを低減させることができる。また、個人情報が大きい場合であっても、共通鍵によって暗号化を行うため、暗号化の処理速度の低減を抑えることができる。
【０１７７】
請求項５又は請求項８に記載の発明によれば、発注者を識別する識別情報である公開鍵により、個人情報を復号することができるため、発注者側と秘密情報を通信する必要がなく、発注者の個人情報（プライバシ情報）を強固に保護することができる。
【０１７８】
請求項６に記載の発明によれば、発注者を識別する識別情報である公開鍵により、個人情報を暗号化した共通鍵（暗号化共通鍵）を復号することができるため、発注者側と受注者側との間で、秘密情報を通信する必要がなく、発注者の個人情報（プライバシ情報）を強固に保護することができる。
【図面の簡単な説明】
【図１】本発明の第一及び第二の実施の形態に係る受発注システムの構成を示すブロック図である。
【図２】本発明の第一の実施の形態に係る商品発注端末の構成を示すブロック図である。
【図３】本発明の第一の実施の形態に係る商品受注サーバの構成を示すブロック図である。
【図４】本発明の第一及び第二の実施の形態に係る受発注システムにおいて、商品受注サーバが公開情報を公開する動作を示すフローチャートである。
【図５】本発明の第一の実施の形態に係る商品発注端末が、商品受注サーバに対して発注者の個人情報を暗号化して送信する動作を示すフローチャートである。
【図６】本発明の第一の実施の形態に係る商品受注サーバが、商品発注端末から暗号化された個人情報を受信して復号する動作を示すフローチャートである。
【図７】本発明の第二の実施の形態に係る商品発注端末の構成を示すブロック図である。
【図８】本発明の第二の実施の形態に係る商品受注サーバの構成を示すブロック図である。
【図９】本発明の第二の実施の形態に係る商品発注端末が、商品受注サーバに対して発注者の個人情報を暗号化して送信する動作を示すフローチャートである。
【図１０】本発明の第二の実施の形態に係る商品受注サーバが、商品発注端末から暗号化された個人情報を受信して復号する動作を示すフローチャートである。
【符号の説明】
１、１Ｂ ……受発注システム
２ ……イントラネット
３ ……インターネット
５ ……Ｗｅｂサーバ
１０、１０Ｂ ……商品発注端末
１１ ……公開情報取得手段
１１ａ ……発注者登録部
１１ｂ ……公開情報取得部
１２ ……共通鍵暗号化手段
１３、１３Ｂ ……ＩＤベース暗号化手段
１３ａ ……発注者秘密情報選択部
１３ｂ、１３Ｂｂ……ＩＤ暗号化部
１４ ……発注者公開情報生成手段
１５、１５Ｂ ……合成手段
１６、１６Ｂ ……記憶手段
１７ ……送受信手段
１７ａ ……登録要求送信部
１７ｂ ……公開情報受信部
１７ｃ ……商品要求送信部（個人情報送信手段）
２０、２０Ｂ ……商品受注サーバ
２１ ……公開情報公開手段
２１ａ ……発注者登録受付部
２１ｂ ……公開情報生成部
２１ｃ ……公開情報公開部
２２ ……分離手段
２３、２３Ｂ ……ＩＤベース復号手段
２３ａ ……秘密鍵生成部
２３ｂ、２３Ｂｂ……ＩＤ復号部
２４ ……記憶手段
２５ ……送受信手段
２５ａ ……登録要求受信部
２５ｂ ……公開情報送信部
２５ｃ ……商品要求受信部（個人情報受信手段）
２６ ……共通鍵復号手段
Ｐｉｎｆｏ ……公開情報（受注者公開情報）
Ｕｉｄ ……公開鍵
Ｐｐｕｂ ……発注者公開情報
ｓ ……マスタ鍵（受注者秘密情報）
ｒ ……発注者秘密情報[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a personal information protection method for protecting personal information of an orderer who places an order for a product via a network, a product ordering terminal and a product order receiving server, and a personal information transmitting program and a personal information receiving program.
[0002]
[Prior art]
2. Description of the Related Art Generally, when receiving contents or purchasing goods via a network such as the Internet such as distribution of digital contents (hereinafter, simply referred to as contents) or online shopping, a terminal device on the orderer side (product ordering terminal) From a product (content) order receiving party (hereinafter simply referred to as the order receiving party), a server (a product order receiving server) side receives a content request form describing the content name desired by the orderer, purchased product information, or a charge. A credit card number or the like used for payment is transmitted. The various types of information transmitted to the server on the contractor side are personal information (privacy information) of the orderer, and it is necessary to prevent leakage to third parties.
[0003]
Therefore, conventionally, a method of protecting personal information by using a public key cryptosystem such as PKI (Public Key Infrastructure) and SSL (Single Socket Layer) has been adopted.
[0004]
When encrypting the orderer's personal information using PKI, the personal information is encrypted using a public key pair (public key and private key) recognized by a third party called a certificate authority. For example, when transmitting personal information of an orderer requiring protection such as a credit card number from a terminal device on the orderer side to a server on the orderer side, the personal information is encrypted with a public key published by the orderer. Send to server. This encrypted personal information can be decrypted only with a private key that is a pair of a public key owned by the contractor, and cannot be referenced by anyone other than the contractor. Thereby, the personal information of the orderer can be protected (for example, see Non-Patent Document 1).
[0005]
When encrypting the personal information of the orderer using SSL, the personal information is encrypted by the following procedure. That is, first, a communication path is established between the terminal device on the orderer side and the server on the orderer side. Thereafter, the public key (orderer public key) generated by the terminal device is transmitted to the server, and the server transmits an encryption key encrypted with the orderer public key to the terminal device.
[0006]
Then, the terminal device decrypts the encrypted encryption key with a secret key (orderer private key) that is a pair of the orderer public key. At this stage, the encryption key has been shared between the terminal device and the server. Therefore, using the encryption key, the terminal device encrypts the personal information of the orderer and transmits the encrypted information to the server. As a result, a third party who does not have an encryption key cannot refer to the orderer's personal information and can protect the personal information.
[0007]
In SSL, each time a communication path is established between the terminal device and the server, the orderer's public key pair (orderer's public key and orderer's private key) is generated to secure the communication path (information Is not leaked).
[0008]
[Non-patent document 1]
Warwick Ford, Michael Baum, Translated by Shinichiro Yamada, Digital Signatures and Cryptography, Second Edition, Pearson Education, Inc., October 10, 2001, p. 75-117
[0009]
[Problems to be solved by the invention]
However, in the above-described conventional technology, in the technology of encrypting the orderer's personal information using PKI, when the public key pair (public key and secret key) is leaked to a third party, the orderer's personal information is There was a problem of being referred by a third party. Furthermore, in this case, in order to perform revocation registration of a leaked public key pair, registration of a new public key pair, and the like, a key must be authenticated by a certificate authority, which incurs a cost for the authentication. There was a problem.
[0010]
In the technology for encrypting personal information using SSL, a public key is generated every time a communication path is established between a terminal device and a server, thereby ensuring the security of the communication path. Therefore, there has been a problem that the communication cost for establishing a communication path increases. In addition, when accessed from a large number of terminal devices, a heavy load is imposed on the server. Furthermore, SSL does not take measures to prevent a malicious third party from impersonating the contractor, so if the third party impersonates the contractor, the personal information of the orderer will be leaked to the third party. There was a problem that it would.
[0011]
The present invention has been made in view of the above problems, and encrypts personal information transmitted from an orderer of a product to an orderer with a public key that does not require authentication of a key by a certificate authority. The object of the present invention is to provide a personal information protection method, a product ordering terminal and a product order receiving server, and a personal information transmitting program and a personal information receiving program which can reduce communication costs and protect the orderer's personal information. And
[0012]
[Means for Solving the Problems]
The present invention has been devised to achieve the above object. First, a personal information protection method according to claim 1 places an order for a product from a product ordering terminal to a product ordering server via a network. A personal information protection method for protecting an orderer's personal information transmitted from the product ordering terminal, the method including an information disclosure step, a personal information encryption step, and a personal information decryption step. I do.
[0013]
According to this method, in the personal information protection method, in the information disclosure step, the product order receiving server generates and publishes contractor public information from contractor secret information that is secret information of the contractor that specifies the orderer. . Then, in the personal information encryption step, the product ordering terminal uses the identification information for identifying the orderer as a public key in the ID-based encryption method, and the public key and orderer secret information that is secret information on the orderer side; The personal information is encrypted with the contractor public information disclosed in the information disclosure step to obtain encrypted personal information. Then, in the personal information decrypting step, the commodity order receiving server decrypts the encrypted personal information into personal information based on the public key, the contractor secret information, and the orderer public information.
[0014]
In this way, by the encryption method using the identification information for identifying the orderer as the public key, the product ordering terminal can check the orderer's public information generated from the orderer's secret information and the orderer's secret information that is the orderer's secret information. The product information server encrypts the personal information based on the information, and the product order receiving server decrypts the encrypted personal information into the personal information based on the public key, the orderer secret information, and the orderer public information. Encryption and decryption can be performed without using a public key pair recognized by a third party. As described above, for example, an identity-based encryption scheme is used as an encryption scheme using the identification information for identifying the orderer as a public key.
[0015]
Here, the personal information is a content request form that describes the content name desired by the orderer in a content distribution system, online shopping, or the like, purchased product information, or a credit card number used for payment of a fee. Is the privacy information of the orderer.
[0016]
Further, the personal information protection method according to claim 2 protects the personal information of the orderer transmitted from the product ordering terminal when ordering the product from the product ordering terminal to the product ordering server via the network. A personal information protection method, comprising an information disclosure step, a personal information encryption step, a key encryption step, a key decryption step, and a personal information decryption step.
[0017]
According to this method, in the personal information protection method, in the information disclosure step, the product order receiving server generates and publishes contractor public information from contractor secret information that is secret information of the contractor that specifies the orderer. . Then, in the personal information encryption step, the commodity ordering terminal encrypts the personal information into an encrypted personal information by using a common key in the common key encryption method, and in the key encryption step, the orderer secret information which is the secret information of the orderer. And the contractor public information, the common key is encrypted to be an encrypted common key.
Then, the commodity order receiving server decrypts the encrypted common key into a common key based on the public key, the contractor secret information and the orderer public information in the key decrypting step, and encrypts the encrypted common key with the common key in the personal information decrypting step. Decrypts personalized personal information into personal information.
[0018]
In this way, the product ordering terminal encrypts the personal information with the common key, and encrypts the common key into an encrypted common key by an encryption method using the identification information for identifying the orderer as the public key. For this reason, encryption can be performed without using a public key pair recognized by a third authority such as a certificate authority. An example of such an encryption method using the identification information for identifying the orderer as a public key is an identity-based encryption method.
[0019]
Further, even when the personal information is large, the personal information is encrypted by using a common key cryptosystem capable of encrypting at a higher speed than the Identity-based cryptosystem, thereby lowering the processing speed of the entire encryption. Can be suppressed.
[0020]
Furthermore, the product ordering terminal according to claim 3 generates order-from-order secret information, which is secret information of the order-receiving party that specifies the ordering party beforehand, when ordering a product to the product order-receiving server via the network. A product ordering terminal for encrypting the orderer's personal information based on the published orderer's public information and transmitting the encrypted information to the product ordering server, comprising: a public information acquisition unit; an ID-based encryption unit; Public information generating means and personal information transmitting means.
[0021]
According to this configuration, the commodity ordering terminal acquires the contractor public information generated from the contractor secret information, which is the secret information of the contractor identifying the orderer, by the public information acquisition means, and performs ID-based encryption. Means, the identification information for identifying the orderer is used as a public key in the ID-based encryption method, and personal information is encrypted using the public key, the orderer secret information that is secret information on the orderer side, and the orderer public information. Into encrypted personal information. The product ordering terminal generates orderer public information to be disclosed to the product order receiving server from the orderer secret information by the orderer public information generating means, and the encrypted personal information and the orderer public information by the personal information transmitting means. To the product order server.
[0022]
As described above, the commodity ordering terminal uses the encryption method that uses the identification information for identifying the orderer as the public key, and based on the orderer's public information and the orderer's secret information that is the orderer's secret information, based on the orderer's secret information. The encryption can be performed without using a public key pair recognized by a third party such as a certificate authority. Further, since the merchandise ordering terminal performs the encryption based on the information (contractor public information) disclosed on the contractor side, there is no need to communicate secret information with the contractor side.
[0023]
Further, the product ordering terminal according to claim 4 is configured to generate in advance the orderer's secret information, which is the secret information of the orderer who specifies the orderer, when ordering the item to the item ordering server via the network. A product ordering terminal for encrypting the orderer's personal information based on the released orderer's public information and transmitting the encrypted information to the product ordering server, comprising: a public information acquiring unit; a common key encrypting unit; The configuration includes a base encryption unit, an orderer public information generation unit, and a personal information transmission unit.
[0024]
According to this configuration, the commodity ordering terminal acquires the contractor public information generated from the contractor secret information that is the secret information of the contractor that specifies the orderer by the public information acquisition means, and performs the common key encryption. By means, the personal information is encrypted with a common key in the common key cryptosystem to obtain encrypted personal information. As the common key cryptosystem, for example, a cryptosystem such as DES (Data Encryption Standard) is used. Then, the commodity ordering terminal uses the ID-based encryption means to set the identification information for identifying the orderer as a public key in the ID-based encryption method, and the public key and the orderer secret information which is secret information on the orderer side, The common key is encrypted based on the contractor public information to obtain an encrypted common key.
[0025]
The product ordering terminal generates orderer public information to be disclosed to the product order receiving server from the orderer secret information by the orderer public information generating means, and is encrypted by the common key encrypting means by the personal information transmitting means. The encrypted personal information, the orderer public information generated by the orderer public information generating means, and the encrypted common key encrypted by the ID-based encrypting means are transmitted to the product order receiving server.
[0026]
As described above, the commodity ordering terminal encrypts the personal information with the common key of the common key encryption method, and uses the identity-based encryption method in which the identification information for identifying the orderer is used as the public key. Since the common key is encrypted based on the secret information of the orderer, which is the secret information on the side, a public key pair recognized by a third authority such as a certificate authority is not used. Further, since the merchandise ordering terminal performs the encryption based on the information (contractor public information) disclosed on the contractor side, there is no need to communicate secret information with the contractor side.
[0027]
Further, even when the personal information is large, the personal information is encrypted by a common key encryption method such as an identity-based encryption method, which can encrypt at a higher speed than a public key encryption method, so that the entire encryption can be performed. A reduction in processing speed can be suppressed.
[0028]
Further, the commodity order receiving server according to claim 5 decrypts the orderer's personal information based on the encrypted personal information and the orderer's public information transmitted from the commodity ordering terminal according to claim 3, and A product order receiving server for receiving an order, comprising a personal information receiving unit and an ID-based decrypting unit.
[0029]
According to this configuration, the commodity order receiving server receives the encrypted personal information and the orderer disclosure information from the commodity ordering terminal according to claim 3 by the personal information receiving means, and identifies the orderer by the ID-based decryption means. The encrypted personal information is decrypted into personal information using a secret key generated from a public key that is identification information for identification and contractor secret information that is secret information of the contractor that specifies the orderer.
[0030]
As described above, since the commodity order receiving server can decrypt the personal information by the encryption method using the identification information for identifying the orderer as the public key, the public key pair recognized by the third authority such as the certificate authority can be used. There is no need to communicate secret information with the product ordering terminal.
[0031]
In addition, the commodity order receiving server according to claim 6 transmits the orderer's personal information based on the encrypted personal information, the orderer public information, and the encrypted common key transmitted from the commodity ordering terminal according to claim 4. A commodity order receiving server for decrypting and receiving an order for a commodity, comprising a personal information receiving means, an ID-based decrypting means, and a common key decrypting means.
[0032]
According to this configuration, the commodity order receiving server receives the encrypted personal information, the orderer public information, and the encrypted common key from the commodity ordering terminal according to claim 4 by the personal information receiving means, and the ID-based decryption means And decrypting the encrypted common key into a common key by using a secret key generated from a public key that is identification information for identifying the orderer and orderer secret information that is secret information on the orderer side that identifies the orderer. . Then, the commodity order receiving server decrypts the encrypted personal information into the personal information using the decrypted common key by the common key decrypting means.
[0033]
As described above, the commodity order receiving server can decrypt the common key by using the encryption method using the identification information for identifying the orderer as the public key and decrypt the personal information using the common key. It is possible to obtain personal information without using such a public key pair recognized by a third party.
[0034]
Further, the personal information transmission program according to claim 7, when ordering a product to a product ordering server via a network, the orderer's secret information, which is the secret information of the orderer, which specifies the orderer in advance. In order to transmit the orderer's personal information to the product order receiving server based on the generated and disclosed orderer public information, the computer may be a public information acquiring unit, an ID-based encryption unit, and an orderer public information generating unit. It is characterized by functioning as personal information transmitting means.
[0035]
According to this configuration, the personal information transmission program acquires the contractor public information generated from the contractor secret information, which is the secret information of the contractor that specifies the orderer, by the public information acquisition means, and obtains the ID-based encryption information. The identification information for identifying the orderer is used as a public key in the ID-based encryption method by the converting means, and the personal information is obtained by using the public key, the orderer secret information which is secret information on the orderer side, and the orderer public information. Encrypted to be encrypted personal information. The product ordering terminal generates orderer public information to be disclosed to the product order receiving server from the orderer secret information by the orderer public information generating means, and the encrypted personal information and the orderer public information by the personal information transmitting means. To the product order server.
[0036]
As described above, the commodity ordering terminal uses the encryption method that uses the identification information for identifying the orderer as the public key, and based on the orderer's public information and the orderer's secret information that is the orderer's secret information, based on the orderer's secret information. The encryption can be performed without using a public key pair recognized by a third party such as a certificate authority. Further, since the merchandise ordering terminal performs the encryption based on the information (contractor public information) disclosed on the contractor side, there is no need to communicate secret information with the contractor side.
[0037]
The personal information receiving program described in claim 8 is for obtaining the orderer's personal information based on the encrypted personal information and the orderer's public information transmitted by the personal information transmitting program according to claim 7. The computer is further characterized by functioning as personal information receiving means and ID-based decoding means.
[0038]
According to this configuration, the personal information receiving program receives the encrypted personal information and the orderer public information transmitted by the personal information transmitting program according to claim 7 by the personal information receiving means, and uses the ID-based decrypting means. The private key generated from the public key that is the identification information for identifying the orderer and the contractor secret information that is the secret information of the contractor that identifies the orderer converts the encrypted personal information into personal information. Decrypt.
[0039]
As described above, the personal information receiving program can decrypt the personal information by the encryption method using the identification information for identifying the orderer as the public key, so that the public key recognized by a third party such as a certificate authority can be used. No pair is used, and there is no need to communicate confidential information between the ordering side and the order receiving side.
[0040]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[Ordering System: First Embodiment]
FIG. 1 is a block diagram showing a configuration of an order receiving / ordering system 1 including a product ordering terminal 10 and a product ordering server 20 according to a first embodiment of the present invention. The order receiving and ordering system 1 is a system for realizing online shopping for receiving an order for a product desired by an orderer via the Internet 3. Here, the order receiving / ordering system 1 is composed of a product ordering terminal 10 which is a device on the orderer side, and an order receiving server 20 and a Web server 5 which are connected by an intranet 2 which is a device on the order receiving side.
[0041]
The Web (World Wide Web) server 5 presents, in advance, a product provided (sold) by a contractor as a product list. The product list presented here can be viewed on a Web browser.
[0042]
The product ordering terminal 10 browses a product list presented on the Web server 5 with a Web browser, and places an order (product request) for a product desired by the orderer. The product request includes the product name, a credit number used for payment of a fee, and the like, and serves as privacy information (personal information) of the orderer. Therefore, the product ordering terminal 10 encrypts the product request in which the product request is described and transmits it to the product order server 20. The product ordering terminal 10 is configured to be able to communicate with the Web server 5 and the product ordering server 20 via the Internet 3.
[0043]
The product order server 20 receives a product request (product request form) from the product ordering terminal 10. Since the product request is encrypted, the product order server 20 decrypts the encrypted product request and receives an order for the product. The product order receiving server 20 transmits the product to the product ordering terminal 10 via the Internet 3 from a product distribution server (not shown) connected to the Internet 3 if the requested product can be distributed over the network. I do. Alternatively, the person in charge of ordering delivers the product to the orderer by mail or the like.
[0044]
Thus, the orderer can browse the product list presented by the Web server 5 on the display means (not shown) of the product ordering terminal 10 and place an order for the product to the product order receiving server 20.
[0045]
Although the ordering / ordering system 1 is described here as a system for realizing online shopping, the ordering / ordering system 1 can be implemented as a content distribution system for distributing digital content. In the ordering system 1, the products or digital contents handled by the system may be charged or free. That is, the ordering / ordering system 1 aims to protect personal information when the orderer places an order for a product.
[0046]
(Overview of encryption and decryption of personal information (product request))
Here, in the order receiving / ordering system 1, an outline of an operation of encrypting a product request describing the personal information of the orderer performed by the product order terminal 10 and an operation of decrypting the product request performed by the product order server 20 will be described. explain. The product request form is encrypted using an identity-based encryption method (ID-based encryption method; hereinafter, referred to as an ID encryption method). Here, as an example of the ID encryption method, Boneh, Franklin (Lecture Notes in). Computer Science, Vol.2139, Springer-Verlag, pp.213-229, 2001.).
[0047]
<Public information disclosure>
First, the commodity order receiving server 20 discloses the public information to the commodity ordering terminal 10. Hereinafter, q is a prime number of (q> 3), and p is a prime number of (p mod 3 = 2) and (p = 6q−1). Also, if E is (y²= X³+1) is an elliptic curve on a finite field GF (p).
[0048]
The commodity order receiving server 20 selects an element P which is an element of the elliptic curve E / GF (p) on the finite field GF (p) having the order q, and a master key used for encrypting the personal information. , And the master key s is randomly selected from the set {1, 2,..., Q−1}. Further, the product order receiving server 20 outputs a one-way function (secure hash function: secure hash function) that outputs one element of the group generated by the element P for an arbitrary input as a function F (•). Is selected. In general, a secure hash function is a function in which it is difficult to obtain an input value a when only an output value F (a) for a certain input value a of F (·) is given, and F (a) = F It is a function that is difficult to find the input value pair (a, b) that becomes (b).
[0049]
In addition, the commodity order receiving server 20 selects a function H (•) and a function e (•, •). The function H (•) is a random function in which the input size and the output size are equal. The function e (·, ·) is an elliptic curve that satisfies the expression (1) with respect to two elements P1 and P2 generated by the element P on the elliptic curve E / GF (p) and arbitrary integers a1 and a2. This is a mapping (function) on E / GF (p).
[0050]
e (a1 × P1, a2 × P2) = e (P1, P2)^{a1 × a2} Equation (1)
[0051]
Such mapping includes (deformed) Weil pairing (Lecture Notes in Computer Science, Vol. 2139, Springer-Verlag, pp. 213-229, 2001.).
[0052]
Further, the product order receiving server 20 calculates the key public information Lpub corresponding to the master key s according to the equation (2). It should be noted that the calculation of the expression (2) is performed on the elliptic curve E / GF (p), and in the following, all the calculations are performed on the elliptic curve E / GF (p).
[0053]
Lpub = s × P (2)
[0054]
Then, the product order receiving server 20 converts the {p, q, E, P, Lpub, F (•), H (•), e (•, •)} described above into public information (contractor public information) Pinfo. Published as Further, the master key s is stored as secret information on the contractor side (contractor secret information).
[0055]
<Encryption of personal information (product request form)>
Next, an outline of an operation of encrypting personal information (product request form) in the product ordering terminal 10 will be described. The merchandise ordering terminal 10 registers the orderer (user registration) with the merchandise order receiving server 20 to obtain a public key Uid as identification information for identifying the orderer. The product ordering terminal 10 collects the personal information M such as the product name of the product desired by the orderer and the credit card number with the public information Pinfo and the product ordering terminal 10 in a set {1, 2,. The encryption request C_MAnd However, (+) represents exclusive OR.
[0056]
C_M= M (+) H (e (F (Uid), Lpub)^r) (3)
[0057]
In addition, the product ordering terminal 10 generates orderer public information Ppub, which is public information of the orderer, using Expression (4).
[0058]
Ppub = r × P Equation (4)
[0059]
Then, the product ordering terminal 10 transmits the encrypted request form C generated by the above-described equations (3) and (4)._MAnd the orderer's public information Ppub, and the encrypted personal information EC_M(= ｛C_M, Ppub}) to the product order receiving server 20.
[0060]
<Decryption of personal information (product request form)>
Next, an outline of the decryption operation of the personal information (product request) in the product order receiving server 20 will be described. The product order receiving server 20 stores the encrypted personal information EC received from the product ordering terminal 10._MTo the encryption request form C_MAnd a public key (identification information) Uid for identifying the orderer, a master key s that is secret information on the orderer side corresponding to the public key Uid, and a function F (•). And the secret key U_MGenerate
[0061]
U_M= S × F (Uid) (5)
[0062]
Then, the product order receiving server 20 transmits the encrypted request form C_MAnd the secret key U_M, The orderer's public information Ppub, and the function H (•) and the function e (•, •) based on the equation (6)._MIs decrypted into personal information (product request form) M.
[0063]
C_M(+) H (e (U_M, Ppub)) (6)
[0064]
From the equation (6), the encryption request C_MIs decrypted into personal information M below. The expression (6) can be transformed into the expression (7) by the expressions (3), (4) and (5). Equation (7) can be transformed into equation (8) by equations (1) and (2), and equation (8) can be transformed into equation (9) by equation (2). can do. The terms other than the personal information M in the equation (9) become “1” by exclusive OR, and as a result, only the term of the personal information M remains.
[0065]

[0066]
As described above, the commodity ordering terminal 10 encrypts the personal information M of the orderer based on the public information Pinfo published by the commodity order receiving server 20 using the identification information for identifying the orderer as the public key Uid, It is transmitted to the product order receiving server 20. Further, the commodity order receiving server 20 transmits the encrypted personal information M to the secret key U._MTo decrypt. In this way, it becomes possible for the product ordering terminal 10 and the product order receiving server 20 to manage keys independently.
Hereinafter, the product ordering terminal 10 and the product ordering server 20 according to the present invention will be described in detail.
[0067]
(Configuration of product ordering terminal 10)
First, the configuration of the product ordering terminal 10 will be described with reference to FIG. 2 (see FIG. 1 as appropriate). FIG. 2 is a block diagram illustrating a configuration of the product ordering terminal 10. As shown in FIG. 2, when the orderer places an order for a product, the product ordering terminal 10 transmits a product request obtained by encrypting personal information (product request form) M such as a product name and a credit card number to a product order receiving server. 20. Here, the product ordering terminal 10 includes a public information acquiring unit 11, an ID-based encrypting unit 13, an orderer public information generating unit 14, a combining unit 15, a storing unit 16, and a transmitting / receiving unit 17. Configured.
[0068]
The public information obtaining means 11 registers the orderer (user registration) with the product order server 20 and obtains public information (contractor public information) Pinfo that the product order server 20 discloses. Here, the public information acquisition means 11 is composed of an orderer registration unit 11a and a public information acquisition unit 11b.
[0069]
The orderer registration unit 11a inputs the orderer registration information U including the name of the orderer through input means (not shown), and registers the orderer registration information U in the transmission / reception unit 17. This is to be transmitted to the product order receiving server 20 via the request transmitting unit 17a. This orderer registration is required only by the orderer who places the order for the product, and only needs to be registered once.
[0070]
The public information acquisition unit 11b transmits the public information Pinfo @ p, q, E, P, Lpub, F (•), H (•) transmitted from the commodity order receiving server 20 as a result of the orderer registration by the orderer registration unit 11a. ), E (.,.)} And a public key Uid, which is identification information for identifying the orderer, from the public information receiving unit 17b of the transmitting / receiving unit 17 and store it in the storage unit 16.
[0071]
The ID-based encryption unit 13 encrypts personal information M such as a product name ordered by the orderer and a credit card number used for payment of a fee using a public key Uid. Here, the ID-based encryption means 13 is composed of an orderer secret information selection unit 13a and an ID encryption unit 13b.
[0072]
The orderer secret information selecting unit 13a selects and outputs any one value from the set {1, 2,..., Q-1} (q: order). The value selected here is notified to the ID encrypting unit 13b and the orderer public information generating means 14 as orderer secret information r.
[0073]
The ID encrypting unit 13b inputs personal information (product request form) M from an input means (not shown), performs encryption by an ID encryption method, and performs an encryption request form C._MIs generated. In the ID encrypting unit 13b, the input personal information (product request form) M, the orderer secret information r selected by the orderer secret information selecting unit 13a, and the public key Uid stored in the storage unit 16. And the key public information Lpub of the public information Pinfo, based on the function F (•), the function e (•, •) and the function H (•) of the public information Pininfo, by the above-mentioned equation (3). Encryption request form C_MGenerate Note that the generated encryption request form C_MIs notified to the synthesizing means 15.
[0074]
The orderer public information generating means 14 multiplies the orderer secret information r selected by the orderer secret information selecting section 13a by the element P of the public information Pinfo stored in the storage means 16 (formula (4)). ), And generates orderer public information Ppub, which is public information of the orderer. The generated orderer public information Ppub is notified to the synthesizing unit 15.
[0075]
The synthesizing unit 15 transmits the encrypted request C generated by the ID encrypting unit 13b._MAnd the orderer's public information Ppub generated by the orderer's public information generating means 14 to synthesize the encrypted personal information EC._M(= ｛C_M, Ppub}). The synthesizing by the synthesizing means 15 is performed by the input data (｛C_M, Ppub}), and the header information in which the connected position is written is encrypted personal information EC._MShall be added to Alternatively, the images may be combined in a predetermined arrangement between the combining side and the separating side. The encrypted personal information EC synthesized by the synthesizing means 15_MIs notified to the product request transmission unit (personal information transmission unit) 17c of the transmission / reception unit 17.
[0076]
The storage unit 16 identifies the orderer with the public information Pinfo {p, q, E, P, Lpub, F (•), H (•), e (•, •)} acquired by the public information acquisition unit 11. A public key Uid, which is identification information to be stored, is stored in a general hard disk or the like.
[0077]
The transmission / reception means 17 transmits data to the product order receiving server 20 and receives data from the product order receiving server 20. Here, the transmission / reception means 17 includes a registration request transmission unit 17a, a public information reception unit 17b, and a product request transmission unit 17c.
[0078]
The registration request transmission unit 17a transmits a registration request including the orderer registration information U notified (input) from the orderer registration unit 11a to the product order server 20 via the network (the Internet 3 or the like). is there.
[0079]
The public information receiving unit 17b transmits the public information Pinfo published by the commodity order receiving server 20 and the public key Uid that is the identification information of the orderer as a result of the registration request transmitted by the registration request transmitting unit 17a via the network to the commodity It is received from the order receiving server 20. The public information Pininfo and public key Uid received here are notified to the public information acquisition unit 11b.
[0080]
The product request transmitting unit (personal information transmitting unit) 17c is configured to output the encrypted personal information EC synthesized by the synthesizing unit 15._MIs transmitted to the commodity order receiving server 20 via the network. In addition, in order to identify the orderer, the product request transmitting unit (personal information transmitting unit) 17c converts the public key Uid into the encrypted personal information EC._MTo the product order receiving server 20.
[0081]
As described above, the configuration of the product ordering terminal 10 has been described based on one embodiment, but the public key Uid does not necessarily need to be acquired from the product order receiving server 20. For example, information identifying the orderer, such as the name of the orderer, may be registered as the orderer registration information U (user registration), and the information (name, etc.) identifying the orderer itself may be used as the public key Uid.
[0082]
The public key Uid may be obtained by registering the orderer by mail or the like without using the orderer registration unit 11a. In this case, the public information acquiring unit 11 acquires the public information Pinfo by transmitting the public key Uid input from the input unit (not shown) to the product order receiving server 20.
[0083]
The product ordering terminal 10 can realize each unit other than the storage unit 16 as a function program in a computer, and can operate each unit as a personal information transmission program by combining the function programs.
[0084]
(Configuration of the product order server 20)
Next, the configuration of the commodity order receiving server 20 will be described with reference to FIG. FIG. 3 is a block diagram illustrating a configuration of the product order receiving server 20. As shown in FIG. 3, the product order receiving server 20 registers the orderer in response to the registration request transmitted from the product ordering terminal 10, and stores the product including the orderer's personal information transmitted from the product ordering terminal 10. Upon receiving the request, an order for a product is placed from the registered orderer. Here, the commodity order receiving server 20 includes a public information disclosure unit 21, a separation unit 22, an ID-based decryption unit 23, a storage unit 24, and a transmission / reception unit 25.
[0085]
The public information disclosure unit 21 registers the orderer based on the orderer registration information U notified from the registration request receiving unit 25a of the transmission / reception unit 25, and publishes the public information to the orderer. . Here, the public information disclosure means 21 includes an orderer registration reception unit 21a, a public information generation unit 21b, and a public information disclosure unit 21c.
[0086]
The orderer registration receiving unit 21a registers the orderer based on the orderer registration information U notified from the registration request receiving unit 25a. The orderer registration receiving unit 21a registers a public key Uid, which is identification information for identifying the orderer, for each orderer by storing the public key Uid in the storage unit 24. The public key Uid is an identifier unique to each orderer, and is generated in association with, for example, a name included in the orderer registration information U.
[0087]
The public information generation unit 21b generates public information to be disclosed to the orderer (product ordering terminal 10) that has performed the orderer registration.
The public information generation unit 21b selects prime numbers p and q such that p is (p mod 3 = 2) and (p = 6q-1) with prime numbers of (q> 3), and the order is q. An element P which is an element of the elliptic curve E / GF (p) on the finite field GF (p) is selected. Further, a function F (·) which is a one-way function is selected. Then, the prime numbers p and q, the elliptic curve E, the element P, and the function F (•) are stored in the storage unit 24 in association with the identification information (public key) Uid.
[0088]
Further, the public information generation unit 21b selects an arbitrary value as an integer in the range of 1 to (q-1) and sets it as a master key (contractor secret information) s based on the original P and the master key s. , Public key information Lpub is generated by the above equation (2). The master key s and the key public information Lpub are also stored in the storage unit 24 in association with the public key Uid.
[0089]
The public information disclosure unit 21c reads the public information Pininfo and the public key Uid corresponding to the orderer (product ordering terminal 10) that has performed the orderer registration from the storage unit 24, and makes the information public to the product ordering terminal 10. is there. Here, the public information disclosure unit 21c discloses the information by transmitting the public information Pininfo and the public key Uid to the product ordering terminal 10 via the public information transmission unit 25b.
[0090]
The separation unit 22 is configured to transmit the encrypted personal information EC notified from the product request_MTo the encryption request form C_MAnd the orderer public information Ppub. Encryption request C separated here_MThe orderer public information Ppub is notified to the ID decoding unit 23b of the ID-based decoding unit 23.
[0091]
The ID-based decryption unit 23 transmits the encrypted request form C separated by the separation unit 22._MBased on the orderer public information Ppub also separated by the separating means 22, the public key Uid notified from the product request receiving unit 25c of the transmitting and receiving means 25, and the public information Pinfo stored in the storage means 24. , And personal information (product request form) M. Here, the ID-based decryption means 23 is composed of a secret key generation unit 23a and an ID decryption unit 23b.
[0092]
The secret key generation unit 23a is based on the public key Uid notified from the product request reception unit 25c, the master key s stored in the storage unit 24 corresponding to the public key Uid, and the function F (•). According to the above equation (5), the secret key U_MIs generated. The secret key U generated here_MIs notified to the ID decoding unit 23b. Note that this secret key U_MIs a decryption key for decryption performed by the ID decryption unit 23b.
[0093]
The ID decrypting unit 23b transmits the encrypted request form C separated by the separating unit 22._MIs decrypted into personal information (product request) M by decryption processing in the ID encryption method. In the ID decrypting unit 23b, the encryption request C_MWith the secret key U generated by the secret key generation unit 23a._MAnd the function H (•) and the function e (•, •) stored in the storage unit 24 based on the orderer public information Ppub separated by the separation unit 22 and the decryption by the equation (6). Personal information (product request form) M.
[0094]
The storage means 24 stores the public information Pinfo {p, q, E, P, Lpub, F (•), H (•), e (•, •)}, and a public key Uid serving as identification information for identifying the orderer. And a master key (customer's secret information) s, and comprises a general hard disk or the like.
[0095]
A plurality of prime numbers p and q, an elliptic curve E, an element P, and a function F (•) are stored in the storage unit 24, and the public information generation unit 21b selects them in association with the public key Uid, It shall be disclosed as public information Pininfo. The public key information Lpub is generated by the public information generation unit 21b. The function H (•) and the function e (•, •) are unique functions that satisfy the above-mentioned equation (1) in advance.
[0096]
The transmission / reception unit 25 transmits data to the product ordering terminal 10 and receives data from the product ordering terminal 10. Here, the transmission / reception unit 25 includes a registration request receiving unit 25a, a public information transmitting unit 25b, and a product request receiving unit 25c.
[0097]
The registration request receiving unit 25a receives a registration request including the orderer registration information U transmitted from the product ordering terminal 10 via a network (such as the Internet 3). The orderer registration information U received here is notified to the orderer registration receiving unit 21a.
[0098]
The public information transmission unit 25b transmits (discloses) the public information Pininfo and the public key Uid notified (input) from the public information disclosure unit 21c to the product ordering terminal 10 via a network (such as the Internet 3). is there.
[0099]
The product request receiving unit (personal information receiving means) 25c transmits the encrypted personal information EC transmitted from the product ordering terminal 10 via a network (such as the Internet 3)._MAnd a product request including the public key Uid. Encrypted personal information EC received here_MIs notified to the separation unit 22, and the public key Uid is notified to the ID-based decryption unit 23.
[0100]
As described above, the configuration of the commodity order receiving server 20 has been described based on one embodiment, but the present invention is not limited to this. For example, the secret key U in the secret key generation unit 23a_MIs generated not at the time of decryption of personal information but at the time of orderer registration, and the generated secret key U_MMay be stored in the storage unit 24.
[0101]
Note that the commodity order receiving server 20 can realize each unit other than the storage unit 24 as a function program in a computer, and can operate each unit as a personal information receiving program by combining the function programs.
[0102]
(Operation of ordering system 1)
Next, the operations of the product ordering terminal 10 and the product ordering server 20 in the ordering / ordering system 1 (FIG. 1) will be described with reference to FIGS. FIG. 4 is a flowchart showing an operation in which the product order receiving server 20 discloses the public information to the product ordering terminal 10. FIG. 5 is a flowchart illustrating an operation in which the product ordering terminal 10 encrypts and transmits the orderer's personal information to the product order receiving server 20. FIG. 6 is a flowchart showing an operation in which the product order receiving server 20 receives and decrypts the encrypted personal information from the product ordering terminal 10.
[0103]
First, with reference to FIG. 4 (refer to FIGS. 2 and 3 for the configuration), an operation in which the commodity order receiving server 20 publishes public information (contractor public information) to the commodity ordering terminal 10 will be described.
[0104]
<Information disclosure step>
First, the product ordering terminal 10 inputs the orderer registration information U including the name of the orderer by the orderer registration unit 11a, and the registration request transmitting unit 17a registers the orderer registration information to the product order receiving server 20. By transmitting a registration request including information U, orderer registration (user registration) is performed (step S10).
[0105]
In the commodity order receiving server 20, the registration request receiving unit 25a receives the registration request (step S11), and the orderer registration receiving unit 21a generates, for each orderer, a public key Uid as identification information for identifying the orderer. Is stored in the storage means 24 (step S12).
[0106]
Then, the commodity order receiving server 20 selects the master key (contractor secret information) s with an integer in the range of 1 to (order q-1) by the public information generation unit 21b (step S13), and the master key s , And generates other public information {p, q, E, P, F (·)}, and stores it in the storage means 24 (step S2). S14).
[0107]
Then, the product order receiving server 20 transmits the public information Pininfo selected / generated in step S14 and the public key Uid generated in step S12 to the product ordering terminal via the public information transmitting unit 25b by the public information publishing unit 21c. 10 (step S15).
On the other hand, in the commodity ordering terminal 10, the public information receiving unit 17b receives the public information Pininfo and the public key Uid, and stores them in the storage unit 16 (step S16).
[0108]
By the above operation, the product ordering terminal 10 registers the orderer with the product ordering server 20 and obtains the public information Pinfo necessary for encrypting the personal information M of the orderer. it can. In this case, the public information Pinfo is obtained simultaneously with the orderer registration. However, only the orderer registration is performed first to obtain the public key Uid, and thereafter, based on the public key Uid, The public information Pininfo may be obtained.
[0109]
Next, with reference to FIG. 5 (see FIG. 2 as appropriate), an operation in which the product ordering terminal 10 encrypts the personal information M and transmits it to the product order receiving server 20 (FIG. 1) will be described.
[0110]
<Personal information (product request) encryption step>
First, the product ordering terminal 10 inputs personal information (product request form) M such as a product name ordered by the orderer and a credit card number used for payment of a fee by an input means (not shown) (step S20). . Then, the orderer secret information selection unit 13a selects the orderer secret information r with an integer in the range from 1 to (order q-1) (step S21).
[0111]
Then, the product ordering terminal 10 uses the ID encrypting unit 13b to output the personal information M input in step S20, the orderer secret information r selected in step S21, and the orderer's secret information stored in the storage unit 16. The public key Uid, which is the identification information, and the key public information Lpub included in the public information Pinfo are combined based on the function F (•), the function e (•, •), and the function H (•) also included in the public information Pininfo. According to the above equation (3), encryption by the ID encryption method is performed, and the encryption request C_MIs generated (step S22).
[0112]
Further, the product ordering terminal 10 multiplies the orderer secret information r selected in step S21 by the orderer public information generation means 14 and the element P included in the public information Pininfo stored in the storage means 16 ( (Equation (4)), and generates orderer public information Ppub, which is public information of the orderer (step S23).
[0113]
Then, the merchandise ordering terminal 10 transmits the encrypted request form C generated in step S22 by the synthesizing unit 15._MAnd the orderer's public information Ppub generated in step S23 to synthesize the encrypted personal information EC._MIs generated (Step S24), and the encrypted personal information EC is transmitted by the commodity request transmitting section (personal information transmitting means) 17c._MAnd the public key Uid to the product order receiving server 20 (FIG. 1) (step S25).
[0114]
By the above operation, the product ordering terminal 10 can exchange information other than the information disclosed with the product order receiving server 20 (FIG. 1) without using the key authenticated by the third authority such as the certificate authority. The personal information M can be encrypted without performing it.
[0115]
Next, with reference to FIG. 6 (see FIG. 3 as appropriate), an operation in which the product order receiving server 20 receives and decrypts the encrypted personal information from the product ordering terminal 10 will be described.
[0116]
<Personal information (product request) decryption step>
First, the product order receiving server 20 uses the product request receiving unit (personal information receiving means) 25c to encrypt the personal information EC._MAnd a product request including the public key Uid (step S30).
[0117]
Then, the merchandise order receiving server 20 causes the separating means 22 to transmit the encrypted personal information EC._MTo the encryption request form C_MAnd public information Ppub of the orderer (step S31).
[0118]
Further, the commodity order receiving server 20 uses the private key generation unit 23a of the ID-based decryption unit 23 to transmit the public key Uid received in step S30 and the master key s stored in the storage unit 24 corresponding to the public key Uid. And the function F (•), the secret key U_MIs generated (step S32).
[0119]
Then, the commodity order receiving server 20 transmits the encrypted request form C to the ID decrypting section 23b._MWith the secret key U generated in step S32._MAnd the function H (•) and the function e (•, •) stored in the storage means 24, based on the orderer public information Ppub separated in step S31, and the ID encryption by the above equation (6). The information is decrypted according to the method to obtain personal information (product request form) M (step S33).
[0120]
Through the above operation, the commodity order receiving server 20 can decrypt the personal information encrypted by the commodity ordering terminal 10 without using a key authenticated by a third authority such as a certificate authority.
[0121]
As described above, the order receiving / ordering system 1 according to the present embodiment does not exchange information other than the public information between the product ordering terminal 10 and the product ordering server 20, so that there is no need for confidential communication or the like. Therefore, it is possible to reduce the communication cost caused when the conventional SSL is used. Further, unlike the conventional public key cryptosystem, the ordering / ordering system 1 does not need to store a decryption key for decryption, and operates the product ordering terminal 10 and the product ordering server 20 independently. It becomes possible.
[0122]
In the present embodiment, the orderer secret information r selected by the orderer secret information selecting unit 13a of the product ordering terminal 10 and the master key s selected by the public information generating unit 21b of the product order receiving server 20 are the products This is secret information of the order terminal 10 and the product order receiving server 20. It is very difficult to estimate the secret information based on the public information such as the key public information Lpub, the orderer public information Ppub, and the original P. The problem of deriving the orderer secret information r and the master key s from the key public information Lpub, the orderer public information Ppub, the original P, etc. is called an elliptic discrete logarithm problem, and it is very difficult to solve it. (Tatsuaki Okamoto and Hirosuke Yamamoto, "Modern Encryption", Sangyo Tosho, pp. 119-120).
[0123]
Even if the orderer secret information r and the master key s, which are secret information, are leaked to a third party by some means, the product ordering terminal 10 and the product order receiving server 20 will renew the orderer secret information r and the master Only by selecting the key s and updating the key public information Lpub and the orderer public information Ppub, countermeasures can be taken, and there is no management cost for having the certification authority certify the key.
[0124]
Further, in the present embodiment, personal information is encrypted by using the Boneh, Franklin ID encryption method. However, an encryption method that can use the identification information for identifying the orderer as a public key is used. If so, any encryption method may be used.
[0125]
[Ordering System: Second Embodiment]
Next, an ordering system 1B according to a second embodiment of the present invention will be described with reference to FIG. The ordering system 1B is obtained by changing the product ordering terminal 10 to a product ordering terminal 10B and the product ordering server 20 to a product ordering server 20B in the configuration of the ordering system 1.
[0126]
(Overview of encryption and decryption of personal information (product request))
Here, in the order receiving / ordering system 1B, an outline of an operation of encrypting a product request describing the personal information of the orderer performed by the product ordering terminal 10B and an operation of decrypting the product request performed by the product order server 20 will be described. explain.
[0127]
In the order receiving / ordering system 1 according to the first embodiment, the personal information (product request) is encrypted based on the ID encryption method. Considering the need for encryption, personal information is temporarily encrypted with a common key using a common key encryption method, and the common key (encryption key) is encrypted based on an ID encryption method.
[0128]
<Public information disclosure>
In the order receiving / ordering system 1B, the public information (contractor public information) Pinfo released by the commodity order receiving server 20B is the same as that of the commodity order receiving server 20, $ p, q, E, P, Lpub, F (•), H (•). , E (・, ・)}.
[0129]
<Encryption of personal information (product request form)>
The product ordering terminal 10B includes an encryption request in which personal information (product request) is encrypted with a common key, an encryption common key in which a common key is encrypted by an ID encryption method, and an orderer disclosure made by the orderer. And generate information. Here, the encryption of the personal information (product request form) may be any encryption method as long as it is a common common key encryption method. Hereinafter, the personal information (product request) is M, and the encryption request is C_M, The common key is Ks, the encrypted common key is Eks, and the orderer public information is r.
[0130]
First, the product ordering terminal 10B stores the encrypted common key Eks in the public information Pinfo, the public key Uid as identification information for identifying the orderer, and a set {1, 2,..., Q-1} (q: Based on the orderer secret information r, which is the secret information of the orderer uniquely selected from (number), and is generated by equation (10).
[0131]
Eks = Ks (+) H (e (F (Uid), Lpub)^r) (10)
[0132]
In addition, the product ordering terminal 10B generates orderer public information Ppub, which is public information of the orderer, using Expression (11) (the same as Expression (4)).
[0133]
Ppub = r × P Expression (11)
[0134]
Then, the product ordering terminal 10B transmits the encrypted request form C encrypted with the common key Ks._MAnd the encrypted common key Eks and the orderer public information Ppub generated by the above equations (10) and (11), and the encrypted personal information EC_M(= ｛C_M, Eks, Ppub}) to the product order receiving server 20B.
[0135]
<Decryption of personal information (product request form)>
Next, an outline of the decryption operation of the personal information (product request) in the product order receiving server 20B will be described. The product order receiving server 20B stores the encrypted personal information EC received from the product ordering terminal 10B._MTo the encryption request form C_MAnd an encrypted common key Eks and an orderer public information Ppub, and a public key (identification information) Uid for identifying the orderer, and a master key s as secret information on the orderer side corresponding to the public key Uid. , The function F (•), and the secret key U_MGenerate
[0136]
U_M= S × F (Uid) (12)
[0137]
Then, the product order receiving server 20B transmits the encrypted common key Eks and the secret key U_MBased on the public information Ppub of the orderer, the function H (•), and the function e (•, •), the encrypted common key Eks is decrypted into the common key Ks by Expression (13).
[0138]
Eks (+) H (e (U_M, Ppub)) (13)
[0139]
It is proved below that the encrypted common key Eks is decrypted into the common key Ks by the equation (13). The expression (13) can be transformed into the expression (14) by the expressions (10), (11) and (12). Equation (14) can be transformed into equation (15) by equations (1) and (2), and equation (15) can be transformed into equation (16) by equation (2). can do. The terms other than the common key Ks in the equation (16) become “1” by exclusive OR, and as a result, only the term of the common key Ks remains.
[0140]

[0141]
Then, the commodity order receiving server 20B uses the decrypted common key Ks to generate an encryption request C_MCan be obtained, the personal information M of the orderer can be obtained.
Hereinafter, the product ordering terminal 10B and the product order receiving server 20B according to the present invention will be described in detail.
[0142]
(Configuration of product ordering terminal 10B)
First, the configuration of the product ordering terminal 10B will be described with reference to FIG. FIG. 7 is a block diagram illustrating a configuration of the product ordering terminal 10B. As shown in FIG. 7, when the orderer places an order for a product, the product ordering terminal 10B transmits a product request obtained by encrypting personal information (product request form) M such as a product name and a credit card number to a product order receiving server. 20B (FIG. 1).
[0143]
Here, the commodity ordering terminal 10B is connected to the public information acquisition unit 11, the common key encryption unit 12, the ID-based encryption unit 13B, the orderer public information generation unit 14, the synthesis unit 15B, and the storage unit 16B. , Transmitting and receiving means 17. The configuration other than the common key encryption unit 12, the ID-based encryption unit 13B, the combining unit 15B, and the storage unit 16B is the same as that of the product ordering terminal 10 described in FIG. Is omitted.
[0144]
The common key encrypting means 12 encrypts personal information M such as a product name ordered by the orderer and a credit card number used for payment of a fee by using a common key Ks based on a common encryption method stored in the storage means 16B in advance. And encryption request C_MIs generated. For example, the common key encryption unit 12 performs encryption using a common common key encryption method such as DES (Data Encryption Standard). Encrypted request form C encrypted here_MIs notified to the synthesizing unit 15B.
[0145]
The ID-based encryption unit 13B encrypts the common key Ks stored in the storage unit 16B with the public key Uid. Here, the ID-based encryption means 13B is composed of an orderer secret information selection unit 13a and an ID encryption unit 13Bb. The orderer secret information selection unit 13a is the same as that described with reference to FIG.
[0146]
The ID encryption unit 13Bb encrypts the common key Ks stored in the storage unit 16B by the ID encryption method to generate an encrypted common key Eks. The encrypted common key Eks encrypted here is notified to the synthesizing unit 15B. The function of the ID encryption unit 13Bb is the same as that of the ID encryption unit 13b, except for the input / output data of the ID encryption unit 13b (FIG. 2).
[0147]
The synthesizing unit 15B transmits the encryption request C generated by the common key encrypting unit 12._MAnd the encrypted common key Eks generated by the ID encrypting unit 13Bb and the orderer public information Ppub generated by the orderer public information generating means 14 to synthesize the encrypted personal information EC._M(= ｛C_M, Eks, Ppub}). The encrypted personal information EC synthesized by the synthesizing means 15B_MIs notified to the transmission / reception means 17.
[0148]
The storage unit 16B identifies the orderer with the public information Pinfo {p, q, E, P, Lpub, F (•), H (•), e (•, •)} acquired by the public information acquisition unit 11. It stores a public key Uid, which is identification information, and a common key Ks used for encryption by a common key encryption method, and is configured by a general hard disk or the like.
[0149]
By configuring the product ordering terminal 10B in this manner, the personal information M can be stored in the encrypted request form C using the common key Ks._MAnd the common key Ks is encrypted into an encrypted common key Eks by the ID encryption method. Then, the product ordering terminal 10B transmits the encryption request form C_MBy transmitting the encrypted common key Eks and the orderer public information Ppub to the product order receiving server 20B (FIG. 1), the personal information M can be securely notified to the product order receiving server 20B.
[0150]
(Configuration of the product order server 20B)
Next, a configuration of the product order receiving server 20B will be described with reference to FIG. FIG. 8 is a block diagram illustrating a configuration of the product order receiving server 20B. As shown in FIG. 8, the product order receiving server 20B registers the orderer in response to the registration request transmitted from the product ordering terminal 10B (FIG. 1), and also transmits the orderer's personal information transmitted from the product ordering terminal 10B. Is received, and an order for a product is received from the registered orderer.
[0151]
Here, the product order receiving server 20B includes a public information disclosure unit 21, a separation unit 22B, an ID-based decryption unit 23B, a storage unit 24, a transmission / reception unit 25, and a common key decryption unit 26. The configuration other than the separation unit 22B, the ID-based decryption unit 23B, and the common key decryption unit 26 is the same as that of the commodity order receiving server 20 described with reference to FIG.
[0152]
The separating unit 22B is configured to transmit the encrypted personal information EC notified from the transmitting / receiving unit 25._MTo the encryption request form C_MAnd the encrypted common key Eks and the orderer public information Ppub. The encrypted common key Eks and the orderer public information Ppub separated here are notified to the ID decryption unit 23Bb of the ID-based decryption unit 23B. Also, encryption request C_MIs notified to the common key decryption means 26.
[0153]
The ID-based decryption unit 23B converts the encrypted common key Eks separated by the separation unit 22B into the orderer public information Ppub also separated by the separation unit 22B, the public key Uid notified from the transmission / reception unit 25, and the storage unit. Based on the public information Pininfo stored in the storage device 24, the common key Ks is decrypted. Here, the ID-based decryption unit 23B is composed of a secret key generation unit 23a and an ID decryption unit 23Bb. The secret key generation unit 23a is the same as that described with reference to FIG.
[0154]
The ID decryption unit 23Bb decrypts the encrypted common key Eks separated by the separation unit 22B into a common key Ks by a decryption process in the ID encryption method. Here, the decrypted common key Ks is notified to the common key decrypting means 26. The function of the ID decoding unit 23Bb is the same as that of the ID decoding unit 23b except for the input / output data of the ID decoding unit 23b (FIG. 3).
[0155]
The common key decrypting means 26 transmits the encrypted request form C separated by the separating means 22B._MIs decrypted into personal information (product request form) M by the common key Ks decrypted by the ID decryption unit 23Bb.
[0156]
By configuring the product order receiving server 20B in this manner, the encrypted personal information EC, which is a product request notified from the product ordering terminal 10B (FIG. 1), is provided._MIs decrypted into a common key Ks by decryption using the ID encryption method, and the encryption request key Cs is decrypted using the common key Ks._MIs decrypted into personal information (product request form) M.
[0157]
(Operation of ordering system 1B)
Next, the operations of the product ordering terminal 10B and the product ordering server 20B in the ordering / receiving system 2 (FIG. 1) will be described with reference to FIGS. FIG. 9 is a flowchart showing an operation in which the product ordering terminal 10B encrypts and transmits the personal information of the orderer to the product ordering server 20B. FIG. 10 is a flowchart showing an operation in which the product order receiving server 20B receives and decrypts the encrypted personal information from the product ordering terminal 10B. The operation (information disclosure step) of the commodity order receiving server 20B publishing the public information (contractor public information) to the commodity ordering terminal 10B is the same as the operation described in FIG. .
[0158]
Next, with reference to FIG. 9 (see FIG. 7 as appropriate), an operation in which the product ordering terminal 10B encrypts the personal information M and transmits it to the product order receiving server 20B (FIG. 1) will be described.
[0159]
<Personal information (product request) encryption step>
First, the product ordering terminal 10B inputs personal information (product request form) M such as a product name ordered by the orderer and a credit card number used for payment of a fee by an input means (not shown) (step S40). . Then, the commodity ordering terminal 10B encrypts the personal information M by using the common key Ks stored in the storage unit 16B by the common key encryption unit 12, and the encryption request C_M(Step S41).
[0160]
<Key encryption step>
In addition, the commodity ordering terminal 10B selects the orderer secret information r with an integer in the range of 1 to (order q-1) by the orderer secret information selecting unit 13a of the ID-based encryption means 13B (step S42). .
[0161]
Then, the product ordering terminal 10B uses the ID encrypting unit 13Bb to determine the orderer secret information r selected in step S42, the public key Uid that is the orderer identification information stored in the storage unit 16B, and the public information Based on the public key information Lpub, the function F (•), the function e (•, •), and the function H (•) included in the Pinfo, the common key Ks used in step S41 is calculated by the above equation (10). The encryption is performed by the ID encryption method to generate an encrypted common key Eks (step S43).
[0162]
<Orderer public information generation step>
Further, the product ordering terminal 10B multiplies the orderer secret information r selected in step S42 by the orderer public information generation means 14 and the element P included in the public information Pininfo stored in the storage means 16B ( (Equation (11)), and generates orderer public information Ppub, which is public information of the orderer (step S44).
[0163]
<Encrypted personal information transmission step>
Then, the merchandise ordering terminal 10B transmits the encrypted request form C encrypted in step S41 by the synthesizing unit 15B._MAnd the encrypted common key Eks encrypted in step S43 and the orderer public information Ppub generated in step S44, and the encrypted personal information EC_MIs generated (step S45), and the encrypted personal information EC is transmitted via the transmission / reception means 17._MAnd the public key Uid are transmitted to the product order receiving server 20B (FIG. 1) (step S46).
[0164]
By the above operation, the commodity ordering terminal 10B exchanges information other than the information disclosed with the commodity order receiving server 20 (FIG. 1) without using the key authenticated by the third authority such as the certificate authority. The personal information M can be encrypted without performing it. In addition, since the product ordering terminal 10B encrypts the personal information M by a general common key encryption method, it is possible to encrypt the personal information M at almost the same speed as in the related art. Can be protected.
[0165]
<Decryption of personal information (product request)>
Next, referring to FIG. 10 (see FIG. 8 as appropriate), the operation of the commodity order receiving server 20B receiving and decrypting the encrypted personal information from the commodity ordering terminal 10B (FIG. 1) (encrypted personal information decryption). Step) will be described.
[0166]
<Encrypted personal information receiving step>
First, the commodity order receiving server 20B sends the encrypted personal information EC from the commodity ordering terminal 10 (FIG. 1) by the transmission / reception means 25._MAnd a product request including the public key Uid (step S50).
[0167]
Then, the commodity order receiving server 20B uses the separating means 22B to encrypt the personal information EC._MTo the encryption request form C_MAnd the encrypted common key Eks and the orderer public information Ppub (step S51).
[0168]
In addition, the commodity order receiving server 20B uses the secret key generation unit 23a of the ID-based decryption unit 23B to transmit the public key Uid received in step S50 and the master key s stored in the storage unit 24 corresponding to the public key Uid. And the function F (•), the secret key U_MIs generated (step S52).
[0169]
<Key decryption step>
Then, the merchandise order receiving server 20B uses the secret key U generated in step S52 in the ID decryption unit 23Bb._MAnd the orderer public information Ppub separated in step S51 and the function H (•) and the function e (•, •) stored in the storage means 24, and the ID encryption is performed by the above equation (13). The encrypted common key Eks is used as the common key Ks (step S53).
[0170]
<Personal information decryption step>
Then, the commodity order receiving server 20B uses the common key Ks decrypted in step S53 by the common key decryption means 26 to encrypt the_MIs decrypted into personal information (product request form) M (step S54).
[0171]
By the above operation, the product order receiving server 20B can decrypt the personal information encrypted by the product ordering terminal 10B (FIG. 1) without using a key authenticated by a third authority such as a certificate authority.
[0172]
【The invention's effect】
As described above, the personal information protection method, the product ordering terminal, the product order receiving server, the personal information transmission program, and the personal information receiving program according to the present invention have the following excellent effects.
[0173]
According to the first aspect of the present invention, in the product ordering terminal, the personal information which is the privacy of the orderer is encrypted with the public key (identification information) for specifying the orderer and the contractor public information, In order to decrypt the personal information using the public key, the orderer's public information, and the secret key (the orderer's secret information) that generated the contractor's public information, the third party, such as a certificate authority, is authorized to decrypt the personal information. There is no need to use a public key pair. Therefore, it is possible to operate the ordering side (product ordering terminal) and the order receiving side (product ordering server) independently, and it is not necessary to communicate both sides of secret information such as SSL, and secret information management. The cost associated with can be reduced.
[0174]
According to the second aspect of the present invention, the common key obtained by encrypting the personal information is encrypted with the public key (identification information) for specifying the orderer and the contractor public information. The public key is decrypted using the public information of the orderer and the secret key (the private information of the contractor) that generated the public information of the contractor, and the private information is decrypted with the common key. There is no need to use a public key pair recognized by the institution. Therefore, there is no need to communicate confidential information between the ordering side (commodity ordering terminal) and the order receiving side (commodity ordering server), and costs related to confidential information management can be reduced. Further, even when the personal information is large, since the encryption is performed using the common key, a reduction in the processing speed of the encryption can be suppressed.
[0175]
According to the invention described in claim 3 or claim 7, since the personal information which is the privacy of the orderer is encrypted by using the public key (identification information) for specifying the orderer and the contractor public information, There is no need to communicate confidential information between the contractor and the contractor, so that costs related to confidential information management can be reduced.
[0176]
According to the fourth aspect of the present invention, the personal information which is the privacy of the orderer is encrypted with the common key, and the common key is encrypted with the public key (identification information) for specifying the orderer and the contractor public information. Therefore, there is no need to communicate confidential information between the orderer side and the order receiving side, and costs related to confidential information management can be reduced. Further, even when the personal information is large, since the encryption is performed using the common key, a reduction in the processing speed of the encryption can be suppressed.
[0177]
According to the invention described in claim 5 or claim 8, since the private information can be decrypted by using the public key which is the identification information for identifying the orderer, there is no need to communicate the secret information with the orderer. In addition, personal information (privacy information) of the orderer can be firmly protected.
[0178]
According to the invention described in claim 6, the common key (encrypted common key) obtained by encrypting the personal information can be decrypted by the public key which is the identification information for identifying the orderer. There is no need to communicate confidential information with the contractor, and personal information (privacy information) of the orderer can be strongly protected.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of an ordering system according to first and second embodiments of the present invention.
FIG. 2 is a block diagram showing a configuration of a product ordering terminal according to the first embodiment of the present invention.
FIG. 3 is a block diagram illustrating a configuration of a product order receiving server according to the first embodiment of the present invention.
FIG. 4 is a flowchart showing an operation in which a commodity order receiving server publishes public information in the order receiving system according to the first and second embodiments of the present invention.
FIG. 5 is a flowchart showing an operation in which the product ordering terminal according to the first embodiment of the present invention encrypts and transmits the orderer's personal information to the product ordering server.
FIG. 6 is a flowchart showing an operation in which the product order receiving server according to the first embodiment of the present invention receives and decrypts encrypted personal information from a product ordering terminal.
FIG. 7 is a block diagram showing a configuration of a product ordering terminal according to a second embodiment of the present invention.
FIG. 8 is a block diagram showing a configuration of a product order receiving server according to a second embodiment of the present invention.
FIG. 9 is a flowchart showing an operation in which the product ordering terminal according to the second embodiment of the present invention encrypts and transmits personal information of the orderer to the product ordering server.
FIG. 10 is a flowchart showing an operation in which a product order receiving server according to a second embodiment of the present invention receives and decrypts encrypted personal information from a product ordering terminal.
[Explanation of symbols]
1, 1B… Order receiving system
2 Intranet
3 ... Internet
5 Web server
10, 10B …… Product ordering terminal
11 public information acquisition means
11a …… Orderer registration section
11b ...... Public information acquisition unit
12... Common key encryption means
13, 13B ... ID-based encryption means
13a …… Orderer secret information selection section
13b, 13Bb ... ID encryption unit
14 …… Orderer public information generation means
15, 15B ... synthesis means
16, 16B storage means
17 ... Transmitting / receiving means
17a Registration request transmitting unit
17b …… public information receiver
17c …… Product request transmission section (personal information transmission means)
20, 20B …… Product order receiving server
21 …… public information disclosure means
21a …… Orderer registration reception section
21b ... public information generation unit
21c ...... Public Information Disclosure Department
22 Separation means
23, 23B ID-based decryption means
23a secret key generation unit
23b, 23Bb ... ID decoding unit
24 ...... Storage means
25 ...... Transmitting / receiving means
25a ...... Registration request receiving unit
25b …… public information transmission section
25c Product request receiving unit (personal information receiving means)
26… common key decryption means
Pinfo ... Public information (Public orderer public information)
Uid ...... Public key
Ppub …… Publicer's public information
s Master key (Contractor secret information)
r …… Orderer's secret information

Claims (8)

A personal information protection method for protecting personal information of an orderer transmitted from the product ordering terminal when ordering a product from a product ordering terminal to a product ordering server via a network,
In the product order receiving server, from the contractor secret information that is the secret information on the contractor side identifying the orderer, information disclosure step of generating and publishing contractor public information,
In the product ordering terminal, the identification information for identifying the orderer is a public key in an ID-based encryption method, the public key, orderer secret information that is secret information on the orderer side, and the orderer public information. By encrypting the personal information into encrypted personal information, a personal information encryption step,
A personal information decrypting step of decrypting the encrypted personal information into the personal information based on the public key and the orderer secret information, and the orderer public information disclosed by the orderer;
Personal information protection method characterized by including. A personal information protection method for protecting personal information of an orderer transmitted from the product ordering terminal when ordering a product from a product ordering terminal to a product ordering server via a network,
In the product order receiving server, from the contractor secret information that is the secret information on the contractor side identifying the orderer, information disclosure step of generating and publishing contractor public information,
In the product ordering terminal, a personal information encryption step of encrypting the personal information with a common key in a common key encryption method to obtain encrypted personal information;
The identification information for identifying the orderer is a public key in the ID-based encryption system, and the public key, the orderer secret information that is secret information on the orderer side, and the orderer public information are used to generate the common key. A key encrypting step of encrypting to become an encrypted common key;
A key decryption step of decrypting the encrypted common key into the common key based on the public key and the contractor secret information, and the purchaser public information disclosed by the purchaser;
A personal information decrypting step of decrypting the encrypted personal information into the personal information by using the common key decrypted in the common key decrypting step;
Personal information protection method characterized by including. Via the network, when ordering a product to the product order server, based on the contractor public information generated and published from the contractor secret information that is the secret information of the contractor that specifies the orderer in advance, A product ordering terminal that encrypts the personal information of the orderer and sends it to the product ordering server,
Public information acquisition means for acquiring the contractor public information,
The identification information for identifying the orderer is a public key in an ID-based encryption method, and the private information is obtained by using the public key, the orderer secret information that is secret information on the orderer side, and the orderer public information. An ID-based encryption means for encrypting the encrypted personal information,
From the orderer secret information, orderer public information generating means for generating orderer public information to be disclosed to the product order receiving server,
Personal information transmitting means for transmitting the encrypted personal information and the orderer public information to the product order server,
A product ordering terminal comprising: Via the network, when ordering a product to the product order server, based on the contractor public information generated and published from the contractor secret information that is the secret information of the contractor that specifies the orderer in advance, A product ordering terminal that encrypts the personal information of the orderer and sends it to the product ordering server,
Public information acquisition means for acquiring the contractor public information,
A common key encrypting means for encrypting the personal information with a common key in a common key cryptosystem to obtain encrypted personal information;
The identification information for identifying the orderer is a public key in an ID-based encryption method, and the public key, the orderer secret information that is secret information on the orderer side, and the orderer public information are used to generate the common key. ID-based encryption means for encrypting and using an encrypted common key,
From the orderer secret information, orderer public information generating means for generating orderer public information to be disclosed to the product order receiving server,
Personal information transmitting means for transmitting the encrypted personal information, the orderer public information and the encrypted common key to the product order receiving server,
A product ordering terminal comprising: A product order server that decrypts the orderer's personal information based on the encrypted personal information and the orderer's public information transmitted from the product ordering terminal according to claim 3, and receives an order for a product,
From the product ordering terminal, personal information receiving means for receiving the encrypted personal information and the orderer public information,
ID-based decryption means for decrypting the encrypted personal information into the personal information by using a secret key generated from the public key and the contractor secret information;
A product order server, comprising: A product order server for decrypting the orderer's personal information based on the encrypted personal information, the orderer's public information, and the encrypted common key transmitted from the product ordering terminal according to claim 4, and receiving an order for a product. hand,
From the product ordering terminal, personal information receiving means for receiving the encrypted personal information, the orderer public information and the encrypted common key,
ID-based decryption means for decrypting the encrypted common key into the common key with a secret key generated from the public key and the contractor secret information;
A common key decryption unit for decrypting the encrypted personal information into the personal information by using the common key decrypted by the ID-based decryption unit;
A product order server, comprising: Via the network, when ordering a product to the product order server, based on the contractor public information generated and published from the contractor secret information that is the secret information of the contractor that specifies the orderer in advance, In order to send the orderer's personal information to the product order server, a computer
Public information acquisition means for acquiring the contractor public information,
The identification information for identifying the orderer is a public key in an ID-based encryption method, and the private information is obtained by using the public key, the orderer secret information that is secret information on the orderer side, and the orderer public information. ID-based encryption means for encrypting and making encrypted personal information;
From the orderer secret information, orderer public information generating means for generating orderer public information to be disclosed to the product order receiving server,
Personal information transmitting means for transmitting the encrypted personal information and the orderer public information to the product order receiving server,
A personal information transmission program characterized by functioning as a personal computer. A computer for acquiring the orderer's personal information based on the encrypted personal information and the orderer's public information transmitted by the personal information transmission program according to claim 7.
Personal information receiving means for receiving the encrypted personal information and the orderer public information,
ID-based decryption means for decrypting the encrypted personal information into the personal information using a secret key generated from the public key and the contractor secret information;
A personal information receiving program characterized by functioning as:

Images